Commit 3cfaeecdb50 for php

commit 3cfaeecdb500d7cf2861721ff6ceebc6cd20f089
Merge: d5b3917cec4 bec9a009fd6
Author: ndossche <7771979+ndossche@users.noreply.github.com>
Date:   Sun Nov 1 11:59:18 2026 +0100

    Merge branch 'PHP-8.5' into PHP-8.6

    * PHP-8.5:
      Fix GH-25091: UAF in phar rename() when source and destination are equal
      Fix GH-25090: UAF in phar rename() of an entry with metadata

diff --cc NEWS
index 9004019b3a5,201799f9b56..52aee8b6eb1
--- a/NEWS
+++ b/NEWS
@@@ -157,10 -226,25 +157,14 @@@ PH
      compressed contents after changing compression). (Raphael Paez)
    . Fixed bug GH-24740 (Oversized tar metadata exhausts the memory limit).
      (Lazizbek Ergashev)
+   . Fixed bug GH-25090 (UAF in phar rename() of an entry with metadata).
+     (Lazizbek Ergashev)
+   . Fixed bug GH-25091 (UAF in phar rename() when source and destination
+     are equal). (Lazizbek Ergashev)

 -- Phpdbg:
 -  . Fix wrong command names. (ndossche, Weilin Du)
 -  . Fixed bug GH-22480 (Use-after-free when re-watching an already-watched
 -    variable). (Ilia Alshanetsky)
 -  . Fixed over-read when watching a packed array element. (Ilia Alshanetsky)
 -  . Fixed double free of watch element chains. (Arnaud)
 -
 -- POSIX:
 -  . Fixed posix_setrlimit() rejecting POSIX_RLIMIT_INFINITY on Solaris.
 -    (Jorg Sowa)
 -
 -- Readline:
 -  . Fixed a crash in readline_info() when completion_append_character
 -    contains a non-ASCII byte. (Weilin Du)
 +- Reflection:
 +  . Fixed bug GH-21768 (Assertion failure in ReflectionProperty::isReadable()
 +    and isWritable() on internal virtual properties). (David Carlier)

  - SAPI:
    . Fixed infinite loop in sapi_header_op() for headers of 4 GiB or more.
diff --cc ext/phar/stream.c
index ef8b153b7e9,7cb417926e3..86ec22e719f
--- a/ext/phar/stream.c
+++ b/ext/phar/stream.c
@@@ -860,19 -835,22 +860,25 @@@ static int phar_wrapper_rename(php_stre
  		if (entry->is_deleted) {
  			php_url_free(resource_from);
  			php_url_free(resource_to);
 -			php_error_docref(NULL, E_WARNING, "phar error: cannot rename \"%s\" to \"%s\" from extracted phar archive, source has been deleted", url_from, url_to);
 +			php_stream_wrapper_warn(wrapper, context, options, NotFound,
 +				"phar error: cannot rename \"%s\" to \"%s\" from extracted phar archive, source has been deleted",
 +				url_from, url_to);
  			return 0;
  		}
+ 		if (zend_string_equals(resource_from->path, resource_to->path)) {
+ 			php_url_free(resource_from);
+ 			php_url_free(resource_to);
+ 			return 1;
+ 		}
  		/* transfer all data over to the new entry */
  		memcpy((void *) &new, (void *) entry, sizeof(phar_entry_info));
  		/* mark the old one for deletion */
  		entry->is_deleted = 1;
  		entry->fp = NULL;
  		ZVAL_UNDEF(&entry->metadata_tracker.val);
 +		entry->symlink = NULL;
 +		entry->tmp = NULL;
+ 		entry->metadata_tracker.str = NULL;
 -		entry->link = entry->tmp = NULL;
  		source = entry;

  		/* add to the manifest, and then store the pointer to the new guy in entry