Commit f9129bd1a16 for php

commit f9129bd1a169affba106ce9c6f4b7770c90aa8c8
Author: lazerg <lazerg2@gmail.com>
Date:   Tue Oct 27 17:07:48 2026 +0500

    ext/phar: Bound tar metadata size before allocation

    Reject oversized metadata entries before allocating their contents so
    malformed archives fail without exhausting the memory limit.

    Fixes GH-24740
    Closes GH-24742

diff --git a/NEWS b/NEWS
index 6f447b572e2..ed773193df4 100644
--- a/NEWS
+++ b/NEWS
@@ -148,6 +148,10 @@ PHP                                                                        NEWS
   . Fixed a duplicate warning when ATTR_STATEMENT_CLASS is rejected on a
     persistent connection. (Ilia Alshanetsky)

+- Phar:
+  . Fixed bug GH-24740 (Oversized tar metadata exhausts the memory limit).
+    (Lazizbek Ergashev)
+
 - Phpdbg:
   . Fix wrong command names. (ndossche, Weilin Du)
   . Fixed bug GH-22480 (Use-after-free when re-watching an already-watched
diff --git a/ext/phar/tar.c b/ext/phar/tar.c
index 1f0c3a47275..198f157ca1f 100644
--- a/ext/phar/tar.c
+++ b/ext/phar/tar.c
@@ -588,7 +588,7 @@ zend_result phar_parse_tarfile(php_stream* fp, char *fname, size_t fname_len, ch
 		}

 		if (entry.filename_len >= sizeof(".phar/.metadata")-1 && !memcmp(entry.filename, ".phar/.metadata", sizeof(".phar/.metadata")-1)) {
-			if (FAILURE == phar_tar_process_metadata(newentry, fp)) {
+			if (size > totalsize || FAILURE == phar_tar_process_metadata(newentry, fp)) {
 				if (error) {
 					spprintf(error, 4096, "phar error: tar-based phar \"%s\" has invalid metadata in magic file \"%s\"", fname, entry.filename);
 				}
diff --git a/ext/phar/tests/tar/gh24740.phpt b/ext/phar/tests/tar/gh24740.phpt
new file mode 100644
index 00000000000..e42a38567d1
--- /dev/null
+++ b/ext/phar/tests/tar/gh24740.phpt
@@ -0,0 +1,44 @@
+--TEST--
+GH-24740 (Unbounded size of .phar/.metadata* entry in TAR phar)
+--EXTENSIONS--
+phar
+--INI--
+memory_limit=16M
+--FILE--
+<?php
+function tar_header(string $name, int $size): string
+{
+    $header = str_repeat("\0", 512);
+    $header = substr_replace($header, $name, 0, strlen($name));
+    $header = substr_replace($header, sprintf("%07o\0", 0644), 100, 8);
+    $header = substr_replace($header, sprintf("%07o\0", 0), 108, 8);
+    $header = substr_replace($header, sprintf("%07o\0", 0), 116, 8);
+    $header = substr_replace($header, sprintf("%011o\0", $size), 124, 12);
+    $header = substr_replace($header, sprintf("%011o\0", 1700000000), 136, 12);
+    $header[156] = '0';
+    $header = substr_replace($header, "ustar\0", 257, 6);
+    $header = substr_replace($header, "00", 263, 2);
+
+    $checksum = 0;
+    for ($i = 0; $i < 512; $i++) {
+        $checksum += ($i >= 148 && $i < 156) ? 0x20 : ord($header[$i]);
+    }
+
+    return substr_replace($header, sprintf("%06o\0 ", $checksum), 148, 8);
+}
+
+$fname = __DIR__ . '/gh24740.tar';
+file_put_contents($fname, tar_header('.phar/.metadata.bin', 0x7FFFFE00) . str_repeat("\0", 1024));
+
+try {
+    new PharData($fname);
+} catch (UnexpectedValueException $e) {
+    echo $e->getMessage(), "\n";
+}
+?>
+--CLEAN--
+<?php
+@unlink(__DIR__ . '/gh24740.tar');
+?>
+--EXPECTF--
+phar error: tar-based phar "%sgh24740.tar" has invalid metadata in magic file ".phar/.metadata.bin"