[php-src] PR #24742: Fix GH-24740: Oversized size in tar .phar/.metadata.bin entry
| From: | lazerg | Date: | Mon, 26 Oct 2026 14:02:21 +0000 |
| Subject: | [php-src] PR #24742: Fix GH-24740: Oversized size in tar .phar/.metadata.bin entry | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-39911@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24742
Author: lazerg
The tar parser passed the header size of a
.phar/.metadata* entry straight to
phar_tar_process_metadata(), which allocates that many bytes before reading. A 1.5 KB
tar claiming a 2 GB metadata entry hits the memory limit instead of failing to open. Now a size
larger than the archive is rejected up front, the same way the LongLink check does since #24423.
Fixes #24740