Commit 857ac7f0b34 for php

commit 857ac7f0b34ea9ba71a3e71f6f5b5048ecdf47a7
Author: Georgij Tsarin <nullderef@duck.com>
Date:   Mon Oct 19 23:57:50 2026 +0300

    ext/phar: add upper-bound check on LongLink entry size (#24423)

diff --git a/NEWS b/NEWS
index 9a23a0f14c6..cbd8903c061 100644
--- a/NEWS
+++ b/NEWS
@@ -96,6 +96,10 @@ PHP                                                                        NEWS
   . Reverted the validity check on the flags argument of posix_access().
     (David Carlier)

+- Phar:
+  . Fixed bug GH-22556 (OOM DoS via oversized ././@LongLink entry in TAR phar).
+    (crystarm)
+
 - Readline:
   . Fixed a heap over-read in the interactive shell prompt when cli.prompt is
     set to an empty string. (Ilia Alshanetsky)
diff --git a/ext/phar/tar.c b/ext/phar/tar.c
index 3ab23c81cc0..ee27a38478e 100644
--- a/ext/phar/tar.c
+++ b/ext/phar/tar.c
@@ -441,8 +441,10 @@ zend_result phar_parse_tarfile(
 			last_was_longlink = true;
 			/* support the ././@LongLink system for storing long filenames */

-			/* Check for overflow - bug 61065 */
-			if (entry.uncompressed_filesize == 0 || entry.uncompressed_filesize > totalsize) {
+			/* Check for empty, truncated, or excessively large ././@LongLink filename entries - bug 61065 */
+			if (entry.uncompressed_filesize == 0
+					|| entry.uncompressed_filesize > totalsize
+					|| entry.uncompressed_filesize > UINT16_MAX) {
 				if (error) {
 					spprintf(error, 4096, "phar error: \"%s\" is a corrupted tar file (invalid entry size)", fname);
 				}