Commit 635c85d89f8 for php

commit 635c85d89f80208859283e7924ccad1390c44479
Merge: 8661547102c 2283aa1fac9
Author: Weilin Du <weilindu@php.net>
Date:   Sun Nov 1 14:29:43 2026 +0800

    Merge branch 'PHP-8.5' into PHP-8.6

    * PHP-8.5:
      Fix GH-25089: Heap buffer over-read via crafted alias size in zip-based phar (#25099)

diff --cc NEWS
index 3ede84fe63e,557d2a3783d..9004019b3a5
--- a/NEWS
+++ b/NEWS
@@@ -146,11 -219,9 +146,13 @@@ PH
    . Fixed bug GH-25006 (getColumnMeta() reads out of bounds for an
      out-of-range column index). (Ilia Alshanetsky)

 +- PDO_PGSQL:
 +  . Fixed bug GH-24461 (DISCARD ALL on persistent connection cleanup drops
 +    PgBouncer's prepared statements). (David Carlier, Artem Ukrainskiy)
 +
  - Phar:
+   . Fixed bug GH-25089 (Heap buffer over-read via crafted alias size in
+     zip-based phar). (Lazizbek Ergashev)
    . Fixed bug GH-8469 (Phar::decompressFiles() and Phar::compressFiles() retain
      compressed contents after changing compression). (Raphael Paez)
    . Fixed bug GH-24740 (Oversized tar metadata exhausts the memory limit).
diff --cc ext/phar/zip.c
index 8703979f234,1411bfeb0a8..b1cfd897fa6
--- a/ext/phar/zip.c
+++ b/ext/phar/zip.c
@@@ -644,8 -641,14 +644,7 @@@ zend_result phar_parse_zipfile

  			zend_off_t restore_pos = php_stream_tell(fp);
  			php_stream_seek(fp, entry.offset, SEEK_SET);
 -			/* these next lines should be for php < 5.2.6 after 5.3 filters are fixed */
 -			fp->writepos = 0;
 -			fp->readpos = 0;
 -			php_stream_seek(fp, entry.offset, SEEK_SET);
 -			fp->writepos = 0;
 -			fp->readpos = 0;
 -			/* the above lines should be for php < 5.2.6 after 5.3 filters are fixed */

- 			mydata->alias_len = entry.uncompressed_filesize;
  			if (entry.flags & PHAR_ENT_COMPRESSED_GZ) {
  				filter = php_stream_filter_create("zlib.inflate", NULL, php_stream_is_persistent(fp));