[php-src] PR #25097: Fix GH-25091: UAF in phar rename() when source and destination are equal
| From: | lazerg | Date: | Sat, 31 Oct 2026 17:18:07 +0000 |
| Subject: | [php-src] PR #25097: Fix GH-25091: UAF in phar rename() when source and destination are equal | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-40145@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/25097
Author: lazerg
Renaming a phar entry onto its own name made
zend_hash_str_update_mem() destroy the
source entry, which phar_copy_entry_fp() then read. Renaming to the same path is now a
no-op that returns true, like rename() on a plain file.
Fixes #25091