Skip to content

Fix GH-25091: UAF in phar rename() when source and destination are equal - #25097

Closed
lazerg wants to merge 1 commit into
php:PHP-8.4from
lazerg:fix/gh-25091-phar-rename-self
Closed

lazerg wants to merge 1 commit into
php:PHP-8.4from
lazerg:fix/gh-25091-phar-rename-self

Conversation

@lazerg

@lazerg lazerg commented Oct 31, 2026

Copy link
Copy Markdown
Contributor

Renaming a phar entry onto its own name made zend_hash_str_update_mem() destroy the source entry, which phar_copy_entry_fp() then read. Renaming to the same path is now a no-op that returns true, like rename() on a plain file.

Fixes #25091

@ndossche ndossche left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks

@ndossche ndossche closed this in 24377a0 Nov 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants