Commit 1c96238e5ea for php

commit 1c96238e5ea9fcce300cfd8844b7c59449f8bc36
Merge: e3121ad5c38 f9129bd1a16
Author: Ilia Alshanetsky <ilia@ilia.ws>
Date:   Tue Oct 27 10:39:38 2026 -0400

    Merge branch 'PHP-8.4' into PHP-8.5

diff --cc NEWS
index b4a760f4ebc,ed773193df4..e8d7eb528d0
--- a/NEWS
+++ b/NEWS
@@@ -126,9 -147,11 +126,13 @@@ PH
      (Ilia Alshanetsky)
    . Fixed a duplicate warning when ATTR_STATEMENT_CLASS is rejected on a
      persistent connection. (Ilia Alshanetsky)
 +  . Fixed constructor option errors naming argument #3 ($password) instead
 +    of argument #4 ($options). (Ilia Alshanetsky)

+ - Phar:
+   . Fixed bug GH-24740 (Oversized tar metadata exhausts the memory limit).
+     (Lazizbek Ergashev)
+
  - Phpdbg:
    . Fix wrong command names. (ndossche, Weilin Du)
    . Fixed bug GH-22480 (Use-after-free when re-watching an already-watched
diff --cc ext/phar/tar.c
index ea9b72b5998,198f157ca1f..9ebedfa1d2e
--- a/ext/phar/tar.c
+++ b/ext/phar/tar.c
@@@ -594,10 -587,10 +594,10 @@@ bail
  			++entry.manifest_pos;
  		}

 -		if (entry.filename_len >= sizeof(".phar/.metadata")-1 && !memcmp(entry.filename, ".phar/.metadata", sizeof(".phar/.metadata")-1)) {
 +		if (zend_string_starts_with_literal(entry.filename, ".phar/.metadata")) {
- 			if (FAILURE == phar_tar_process_metadata(newentry, fp)) {
+ 			if (size > totalsize || FAILURE == phar_tar_process_metadata(newentry, fp)) {
  				if (error) {
 -					spprintf(error, 4096, "phar error: tar-based phar \"%s\" has invalid metadata in magic file \"%s\"", fname, entry.filename);
 +					spprintf(error, 4096, "phar error: tar-based phar \"%s\" has invalid metadata in magic file \"%s\"", fname, ZSTR_VAL(entry.filename));
  				}
  				php_stream_close(fp);
  				phar_destroy_phar_data(myphar);