Skip to content

Fix GH-25090: UAF in phar rename() of an entry with metadata - #25098

Closed
lazerg wants to merge 1 commit into
php:PHP-8.4from
lazerg:fix/issue-25090-phar-rename-metadata
Closed

lazerg wants to merge 1 commit into
php:PHP-8.4from
lazerg:fix/issue-25090-phar-rename-metadata

Conversation

@lazerg

@lazerg lazerg commented Oct 31, 2026

Copy link
Copy Markdown
Contributor

phar_wrapper_rename() copies the entry into the new one and clears the old entry's metadata zval, but it left metadata_tracker.str set. When the flush removed the deleted source entry it freed that string, so the renamed entry kept a dangling pointer, read it on the next flush and released it again at shutdown. Clearing str on the source like the zval fixes it.

Fixes #25090

@ndossche ndossche left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

@ndossche ndossche closed this in d082888 Nov 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants