Skip to content

Fix GH-25092: Double free in Phar::copy() on link and mounted entries - #25100

Closed
lazerg wants to merge 2 commits into
php:PHP-8.4from
lazerg:fix/gh-25092-phar-copy-link
Closed

lazerg wants to merge 2 commits into
php:PHP-8.4from
lazerg:fix/gh-25092-phar-copy-link

Conversation

@lazerg

@lazerg lazerg commented Oct 31, 2026 •

Copy link
Copy Markdown
Contributor

Phar::copy() memcpy()s the old entry into the new one, so link and tmp end up shared between the two manifest entries and both free them on shutdown. This duplicates them the same way phar_update_cached_entry() and phar_convert_to_other() already do; tmp is hit when copying a mounted file.

Fixes #25092

Comment thread ext/phar/phar_object.c
newentry.filename_len = tmp_len;
newentry.fp_refcount = 0;

if (newentry.link) {

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Won't this code cause a leak if phar_copy_entry_fp fails down below?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, it would. I now free both in the error path in 1e44fc0.

@lazerg

lazerg commented Nov 1, 2026

Copy link
Copy Markdown
Contributor Author

The Alpine ASan failure is ext/pcntl/tests/001.phpt, which isn't related to this change and passed on the previous push.

@ndossche ndossche left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks

@ndossche ndossche closed this in 99ec102 Nov 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants