Commit 24377a0adc1 for php

commit 24377a0adc16256d48873e237482a841f4f9662c
Author: lazerg <lazerg2@gmail.com>
Date:   Sat Oct 31 22:17:53 2026 +0500

    Fix GH-25091: UAF in phar rename() when source and destination are equal

    Closes GH-25097.

diff --git a/NEWS b/NEWS
index 156a21c1278..f15ac3c808a 100644
--- a/NEWS
+++ b/NEWS
@@ -242,6 +242,8 @@ PHP                                                                        NEWS
     (Lazizbek Ergashev)
   . Fixed bug GH-25090 (UAF in phar rename() of an entry with metadata).
     (Lazizbek Ergashev)
+  . Fixed bug GH-25091 (UAF in phar rename() when source and destination
+    are equal). (Lazizbek Ergashev)

 - Phpdbg:
   . Fix wrong command names. (ndossche, Weilin Du)
diff --git a/ext/phar/stream.c b/ext/phar/stream.c
index bdb78a1ced7..dde8e375ad2 100644
--- a/ext/phar/stream.c
+++ b/ext/phar/stream.c
@@ -846,6 +846,11 @@ static int phar_wrapper_rename(php_stream_wrapper *wrapper, const char *url_from
 			php_error_docref(NULL, E_WARNING, "phar error: cannot rename \"%s\" to \"%s\" from extracted phar archive, source has been deleted", url_from, url_to);
 			return 0;
 		}
+		if (zend_string_equals(resource_from->path, resource_to->path)) {
+			php_url_free(resource_from);
+			php_url_free(resource_to);
+			return 1;
+		}
 		/* transfer all data over to the new entry */
 		memcpy((void *) &new, (void *) entry, sizeof(phar_entry_info));
 		/* mark the old one for deletion */
diff --git a/ext/phar/tests/gh25091.phpt b/ext/phar/tests/gh25091.phpt
new file mode 100644
index 00000000000..3df6c7940eb
--- /dev/null
+++ b/ext/phar/tests/gh25091.phpt
@@ -0,0 +1,24 @@
+--TEST--
+GH-25091: Use-after-free in rename() when source and destination are the same entry
+--EXTENSIONS--
+phar
+--INI--
+phar.readonly=0
+--FILE--
+<?php
+$fname = __DIR__ . '/gh25091.phar';
+
+$phar = new Phar($fname);
+$phar['a'] = 'contents';
+unset($phar);
+
+var_dump(rename('phar://' . $fname . '/a', 'phar://' . $fname . '/a'));
+var_dump(file_get_contents('phar://' . $fname . '/a'));
+?>
+--CLEAN--
+<?php
+@unlink(__DIR__ . '/gh25091.phar');
+?>
+--EXPECT--
+bool(true)
+string(8) "contents"