Commit 2283aa1fac9 for php

commit 2283aa1fac94e1f1b5b918ef5437b9f9c0bcb446
Merge: 24380e4a413 61edcf9be7d
Author: Weilin Du <weilindu@php.net>
Date:   Sun Nov 1 14:25:15 2026 +0800

    Merge branch 'PHP-8.4' into PHP-8.5

    * PHP-8.4:
      Fix GH-25089: Heap buffer over-read via crafted alias size in zip-based phar (#25099)

diff --cc NEWS
index 2e1c9af51b0,e3b60ecc14a..557d2a3783d
--- a/NEWS
+++ b/NEWS
@@@ -219,7 -229,13 +219,9 @@@ PH
    . Fixed bug GH-25006 (getColumnMeta() reads out of bounds for an
      out-of-range column index). (Ilia Alshanetsky)

 -- PDO_SQLite:
 -  . Fixed bug GH-25021 (SQLite createFunction corrupts large integers).
 -    (mvorisek)
 -
  - Phar:
+   . Fixed bug GH-25089 (Heap buffer over-read via crafted alias size in
+     zip-based phar). (Lazizbek Ergashev)
    . Fixed bug GH-8469 (Phar::decompressFiles() and Phar::compressFiles() retain
      compressed contents after changing compression). (Raphael Paez)
    . Fixed bug GH-24740 (Oversized tar metadata exhausts the memory limit).