Commit 628fb1f591f for php
commit 628fb1f591f56e02de6889983ca190fe81c5ab6b
Merge: a2b7ef35554 8b03a99f877
Author: ndossche <7771979+ndossche@users.noreply.github.com>
Date: Sun Nov 1 12:31:21 2026 +0100
Merge branch 'PHP-8.4' into PHP-8.5
* PHP-8.4:
Fix deprecation warn in test
Fix GH-25092: Double free in Phar::copy() on link and mounted entries
diff --cc ext/phar/phar_object.c
index e9f35dfd050,8b467a9abc8..c0285390ba4
--- a/ext/phar/phar_object.c
+++ b/ext/phar/phar_object.c
@@@ -3556,12 -3556,27 +3556,26 @@@ PHP_METHOD(Phar, copy
phar_metadata_tracker_clone(&newentry.metadata_tracker);
- newentry.filename = estrndup(tmp_new_file, tmp_len);
- newentry.filename_len = tmp_len;
+ newentry.filename = zend_string_copy(new_file);
newentry.fp_refcount = 0;
+ if (newentry.link) {
+ newentry.link = estrdup(newentry.link);
+ }
+
+ if (newentry.tmp) {
+ newentry.tmp = estrdup(newentry.tmp);
+ }
+
if (oldentry->fp_type != PHAR_FP) {
if (FAILURE == phar_copy_entry_fp(oldentry, &newentry, &error)) {
- efree(newentry.filename);
+ zend_string_release(newentry.filename);
+ if (newentry.link) {
+ efree(newentry.link);
+ }
+ if (newentry.tmp) {
+ efree(newentry.tmp);
+ }
php_stream_close(newentry.fp);
zend_throw_exception_ex(phar_ce_PharException, 0, "%s", error);
efree(error);