Commit a6b1a9eb591 for php.net
commit a6b1a9eb59150f3a70e404ebcf35da642048b7e1
Merge: b3b31d9b6e4 c91cc1a25df
Author: Weilin Du <weilindu@php.net>
Date: Thu Aug 27 00:13:12 2026 +0800
Merge branch 'PHP-8.5'
* PHP-8.5:
Fix GH-23418: UAF when accessing mounted Phar subdirectories (#23442)
diff --cc NEWS
index 571d8d82e01,3b865718f09..50c3346e17a
--- a/NEWS
+++ b/NEWS
@@@ -1,17 -1,6 +1,21 @@@
PHP NEWS
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? ????, PHP 8.5.11
+?? ??? ????, PHP 8.6.0beta3
+
+- CLI:
+ . Fixed bug GH-23242 (PHP development server does not support Expect
+ 100-continue flow control). (Sjoerd Langkemper)
+
+- Intl:
+ . Fixed a leak in Locale::getKeywords() when a keyword value cannot be
+ read. (iliaal)
+
++- Phar:
++ . Fixed bug GH-23418 (Use-after-free when looking up mounted directories).
++ (Weilin Du)
++
+
+27 Aug 2026, PHP 8.6.0beta2
- Core:
. Fixed bug GH-15375 (Nested "yield from" skips items after a valid() or
diff --cc ext/phar/util.c
index b93bf6940de,58f23a51994..147ddcc91b9
--- a/ext/phar/util.c
+++ b/ext/phar/util.c
@@@ -1321,13 -1410,13 +1321,14 @@@ phar_entry_info *phar_get_entry_info_di
if (error) {
spprintf(error, 4096, "phar error: path \"%s\" exists as file \"%s\" and could not be mounted", path, test);
}
+ efree(mount_path);
+ efree(test);
return NULL;
}
-
- efree(test);
+ efree(mount_path);
- if (NULL == (entry = zend_hash_str_find_ptr(&phar->manifest, path, path_len))) {
+ entry = zend_hash_str_find_ptr(&phar->manifest, path, path_len);
+ if (!entry) {
if (error) {
spprintf(error, 4096, "phar error: path \"%s\" exists as file \"%s\" and could not be retrieved after being mounted", path, test);
}