# Heap Buffer Overflow (READ: 4) in phar_parse_pharfile

Crafted PHAR with misplaced __HALT_COMPILER(); triggers a 4-byte heap over-read in phar_parse_pharfile, leaking adjacent memory or crashing PHP.

- Payout: hidden
- Severity: high
- Program: Internet Bug Bounty
- Found by: cy1337
- Disclosed: 2020-10-10
- CVE: CVE-2018-20783
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/477344
- Library page: https://bugbountylibrary.com/r/h1%3A477344
- Tags: area:oss domain:oss impact:data-leak kind:bounty platform:hackerone sev:high tech:php technique:fuzzing vuln:dos vuln:info-disclosure vuln:memory-corruption

**Target:** PHP ext/phar PHAR file parser (phar_parse_pharfile)
**Root cause:** phar_parse_pharfile reads a 4-byte field past the end of a 10-byte heap buffer when the __HALT_COMPILER(); marker appears at an unexpected offset, without validating remaining buffer length.
**Steps:**
1. Build PHP with ASAN and disable Zend allocator: `USE_ZEND_ALLOC=0`
2. Create phar file from base64 `X19IQUxUX0NPTVBJTEVSKCk7CgAAANQpRbJAlS4oDzkKFD1B2bK4fX3DAgAAAEdCTUI=`
3. Run `USE_ZEND_ALLOC=0 php -d phar.readonly=0 -r "var_dump(new Phar('php-oob4.phar',0,'project.phar'));"`
4. Observe ASAN heap-buffer-overflow READ of size 4 at phar.c:973
**How found:** Fuzzed PHP with AFL against an ASAN-instrumented build; a malformed phar with __HALT_COMPILER(); in an unexpected position produced an out-of-bounds read.
**Insight:** PHAR parsing trusts the position of the __HALT_COMPILER(); marker; fuzzing phar metadata offsets with ASAN quickly surfaces length-check gaps in manifest parsing.