CVE-2015-2301

Community BUG:

Community CODE:

Below is the community patch.

diff --git a/ext/phar/phar_object.c b/ext/phar/phar_object.c

index 3671054..712795b 100644

--- a/ext/phar/phar_object.c

+++ b/ext/phar/phar_object.c

@@ -2139,8 +2139,8 @@ static zval *phar_rename_archive(phar_archive_data *phar, char *ext, zend_bool c

}

its_ok:

if (SUCCESS == php_stream_stat_path(newpath, &ssb)) {

- efree(oldpath);

zend_throw_exception_ex(spl_ce_BadMethodCallException, 0 TSRMLS_CC, "phar \"%s\" exists and must be unlinked prior to conversion", newpath);

+ efree(oldpath);

return NULL;

}

if (!phar->is_data) {