Commit 0e348066349 for php.net

commit 0e3480663493f3b8f55824d6cfae35257ff8800f
Merge: 4c027ea4eaf 71eff1084eb
Author: David Carlier <devnexen@gmail.com>
Date:   Tue May 19 22:58:33 2026 +0100

    Merge branch 'PHP-8.5'

    * PHP-8.5:
      Fix GH-21986: PharData::getContent() crash on infinite recursion with symlinks.

diff --cc ext/phar/util.c
index 2ab20bbd28e,e2e95432a7c..829abc5dfea
--- a/ext/phar/util.c
+++ b/ext/phar/util.c
@@@ -66,23 -65,35 +66,34 @@@ static zend_string *phar_get_link_locat
  phar_entry_info *phar_get_link_source(phar_entry_info *entry) /* {{{ */
  {
  	phar_entry_info *link_entry;
 -	char *link;
+ 	uint32_t depth = 0, max_depth;

 -	if (!entry->link) {
 +	if (!entry->symlink) {
  		return entry;
  	}

- 	link_entry = zend_hash_find_ptr(&(entry->phar->manifest), entry->symlink);
- 	if (link_entry) {
- 		return phar_get_link_source(link_entry);
- 	}
+ 	max_depth = zend_hash_num_elements(&(entry->phar->manifest));
+
 -	while (entry->link) {
++	while (entry->symlink) {
+ 		if (UNEXPECTED(++depth > max_depth)) {
+ 			return NULL;
+ 		}
 -		link = phar_get_link_location(entry);
++		zend_string *link = phar_get_link_location(entry);

- 	zend_string *link = phar_get_link_location(entry);
- 	link_entry = zend_hash_find_ptr(&(entry->phar->manifest), link);
- 	zend_string_release(link);
- 	if (link_entry) {
- 		return phar_get_link_source(link_entry);
 -		if (NULL != (link_entry = zend_hash_str_find_ptr(&(entry->phar->manifest), entry->link, strlen(entry->link))) ||
 -			NULL != (link_entry = zend_hash_str_find_ptr(&(entry->phar->manifest), link, strlen(link)))) {
 -			if (link != entry->link) {
 -				efree(link);
++		if (NULL != (link_entry = zend_hash_find_ptr(&(entry->phar->manifest), entry->symlink)) ||
++			NULL != (link_entry = zend_hash_find_ptr(&(entry->phar->manifest), link))) {
++			if (link != entry->symlink) {
++				zend_string_release(link);
+ 			}
+ 			entry = link_entry;
+ 		} else {
 -			if (link != entry->link) {
 -				efree(link);
++			if (link != entry->symlink) {
++				zend_string_release(link);
+ 			}
+ 			return NULL;
+ 		}
  	}
- 	return NULL;
+ 	return entry;
  }
  /* }}} */