[php-src] PR #25098: Fix GH-25090: UAF in phar rename() of an entry with metadata
| From: | lazerg | Date: | Sat, 31 Oct 2026 17:19:08 +0000 |
| Subject: | [php-src] PR #25098: Fix GH-25090: UAF in phar rename() of an entry with metadata | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-40146@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/25098
Author: lazerg
phar_wrapper_rename() copies the entry into the new one and clears the old entry's
metadata zval, but it left metadata_tracker.str set. When the flush removed the deleted
source entry it freed that string, so the renamed entry kept a dangling pointer, read it on the next
flush and released it again at shutdown. Clearing str on the source like the zval fixes
it.
Fixes #25090