[php-src] master: Merge branch 'PHP-8.6'

Author: Weilin Du (LamentXU123) Date: 2026-10-07T01:52:59+08:00 Commit: https://github.com/php/php-src/commit/29677a01d9ed767e52746abd4f6d0b6870b1f359 Raw diff: https://github.com/php/php-src/commit/29677a01d9ed767e52746abd4f6d0b6870b1f359.diff Merge branch 'PHP-8.6' * PHP-8.6: ext/phar: Fix double-free in webPhar() without PATH_INFO (#24166) Changed paths: A ext/phar/tests/webphar_cgi_no_path_info.phpt M ext/phar/phar_object.c Diff: diff --git a/ext/phar/phar_object.c b/ext/phar/phar_object.c index 1ba650c83e15..c45ae86a3fa5 100644 --- a/ext/phar/phar_object.c +++ b/ext/phar/phar_object.c @@ -665,7 +665,7 @@ PHP_METHOD(Phar, webPhar) spprintf(&path_info, 0, "%s%s", testit, path_info); free_pathinfo = 1; } else { - path_info = testit; + path_info = estrdup(testit); free_pathinfo = 1; entry = estrndup("", 0); entry_len = 0; diff --git a/ext/phar/tests/webphar_cgi_no_path_info.phpt b/ext/phar/tests/webphar_cgi_no_path_info.phpt new file mode 100644 index 000000000000..9991fe68e76f --- /dev/null +++ b/ext/phar/tests/webphar_cgi_no_path_info.phpt @@ -0,0 +1,31 @@ +--TEST-- +Phar::webPhar() double free in CGI when SCRIPT_NAME is set but PATH_INFO is absent +--CGI-- +--EXTENSIONS-- +phar +--INI-- +phar.readonly=0 +phar.require_hash=0 +variables_order=EGPC +register_argc_argv=0 +cgi.fix_pathinfo=0 +--ENV-- +REQUEST_METHOD=GET +SCRIPT_NAME=/webphar_cgi_no_path_info.phar +--FILE-- +<?php +$fname = __DIR__ . '/' . basename(__FILE__, '.php') . '.phar'; +$phar = new Phar($fname); +$phar->addFromString('index.php', '<?php echo "ok\n"; ?>'); +$phar->setStub('<?php +Phar::webPhar(); +__HALT_COMPILER(); ?>'); +unset($phar); +include $fname; +?> +--CLEAN-- +<?php @unlink(__DIR__ . '/' . basename(__FILE__, '.clean.php') . '.phar'); ?> +--EXPECTHEADERS-- +Status: 301 Moved Permanently +Location: /webphar_cgi_no_path_info.phar/index.php +--EXPECT--