Commit cd99c6c8d0a for php.net

commit cd99c6c8d0a3bb2eb034ba17848a492a7735edfd
Merge: 1a4a22fb1e8 a1b68afe090
Author: Weilin Du <weilindu@php.net>
Date:   Fri Aug 28 01:06:11 2026 +0800

    Merge branch 'PHP-8.4' into PHP-8.5

    * PHP-8.4:
      Fix GH-23477: Memory leak on duplicate native Phar manifest entries (#23479)

diff --cc NEWS
index 7ca30795140,31021de0701..040ff57339a
--- a/NEWS
+++ b/NEWS
@@@ -55,11 -57,9 +55,13 @@@ PH
  - Phar:
    . Fixed bug GH-23418 (Use-after-free when looking up mounted directories).
      (Weilin Du)
+   . Fixed bug GH-23477 (Memory leak on duplicate native Phar manifest entries).
+     (Weilin Du)

 +- Readline:
 +  . Fixed the interactive shell not waiting for the pager process to exit.
 +    (Weilin Du)
 +
  - Standard:
    . Fixed an out-of-bounds read when following a redirect response with an
      empty Location header. (iliaal)
diff --cc ext/phar/phar.c
index b707d425f72,fc21692db2c..14791144c38
--- a/ext/phar/phar.c
+++ b/ext/phar/phar.c
@@@ -1236,14 -1230,15 +1236,17 @@@ static zend_result phar_parse_pharfile(
  		entry.is_crc_checked = (manifest_flags & PHAR_HDR_SIGNATURE ? 1 : 0);
  		phar_set_inode(&entry);
  		if (mydata->is_persistent) {
 -			str = zend_string_init_interned(entry.filename, entry.filename_len, 1);
 +			str = zend_string_init_interned(ZSTR_VAL(entry.filename), ZSTR_LEN(entry.filename), 1);
  		} else {
 -			str = zend_string_init(entry.filename, entry.filename_len, 0);
 +			str = entry.filename;
  		}
- 		zend_hash_add_mem(&mydata->manifest, str, (void*)&entry, sizeof(phar_entry_info));
+ 		if (!zend_hash_add_mem(&mydata->manifest, str, (void*)&entry, sizeof(phar_entry_info))) {
+ 			phar_metadata_tracker_free(&entry.metadata_tracker, entry.is_persistent);
 -			pefree(entry.filename, entry.is_persistent);
++			zend_string_free(entry.filename);
++		}
 +		if (mydata->is_persistent) {
 +			zend_string_release(str);
  		}
 -		zend_string_release(str);
  	}

  	snprintf(mydata->version, sizeof(mydata->version), "%u.%u.%u", manifest_ver >> 12, (manifest_ver >> 8) & 0xF, (manifest_ver >> 4) & 0xF);