Commit d0828881d51 for php

commit d0828881d513105238cdb058d15716d1a12a0b45
Author: lazerg <lazerg2@gmail.com>
Date:   Sat Oct 31 22:18:54 2026 +0500

    Fix GH-25090: UAF in phar rename() of an entry with metadata

    Closes GH-25098.

diff --git a/NEWS b/NEWS
index e3b60ecc14a..156a21c1278 100644
--- a/NEWS
+++ b/NEWS
@@ -240,6 +240,8 @@ PHP                                                                        NEWS
     compressed contents after changing compression). (Raphael Paez)
   . Fixed bug GH-24740 (Oversized tar metadata exhausts the memory limit).
     (Lazizbek Ergashev)
+  . Fixed bug GH-25090 (UAF in phar rename() of an entry with metadata).
+    (Lazizbek Ergashev)

 - Phpdbg:
   . Fix wrong command names. (ndossche, Weilin Du)
diff --git a/ext/phar/stream.c b/ext/phar/stream.c
index 19ba48f8750..bdb78a1ced7 100644
--- a/ext/phar/stream.c
+++ b/ext/phar/stream.c
@@ -852,6 +852,7 @@ static int phar_wrapper_rename(php_stream_wrapper *wrapper, const char *url_from
 		entry->is_deleted = 1;
 		entry->fp = NULL;
 		ZVAL_UNDEF(&entry->metadata_tracker.val);
+		entry->metadata_tracker.str = NULL;
 		entry->link = entry->tmp = NULL;
 		source = entry;

diff --git a/ext/phar/tests/gh25090.phpt b/ext/phar/tests/gh25090.phpt
new file mode 100644
index 00000000000..4860e5abfe5
--- /dev/null
+++ b/ext/phar/tests/gh25090.phpt
@@ -0,0 +1,25 @@
+--TEST--
+GH-25090 (Use-after-free in phar_wrapper_rename() with entry metadata)
+--EXTENSIONS--
+phar
+--INI--
+phar.readonly=0
+--FILE--
+<?php
+$fname = __DIR__ . '/gh25090.phar';
+$phar = new Phar($fname);
+$phar['a'] = 'x';
+$phar['a']->setMetadata(['k' => 'v']);
+rename('phar://' . $fname . '/a', 'phar://' . $fname . '/b');
+$phar['c'] = 'y';
+var_dump($phar['b']->getMetadata());
+?>
+--CLEAN--
+<?php
+@unlink(__DIR__ . '/gh25090.phar');
+?>
+--EXPECT--
+array(1) {
+  ["k"]=>
+  string(1) "v"
+}