From fe068ebe67e044954acacd16b509fff19b2b9aa3 Mon Sep 17 00:00:00 2001
From: lazerg <lazerg2@gmail.com>
Date: Sat, 31 Oct 2026 22:18:54 +0500
Subject: [PATCH] Fix GH-25090: UAF in phar rename() of an entry with metadata

---
 ext/phar/stream.c           |  1 +
 ext/phar/tests/gh25090.phpt | 25 +++++++++++++++++++++++++
 2 files changed, 26 insertions(+)
 create mode 100644 ext/phar/tests/gh25090.phpt

diff --git a/ext/phar/stream.c b/ext/phar/stream.c
index 19ba48f87500..bdb78a1ced7c 100644
--- a/ext/phar/stream.c
+++ b/ext/phar/stream.c
@@ -852,6 +852,7 @@ static int phar_wrapper_rename(php_stream_wrapper *wrapper, const char *url_from
 		entry->is_deleted = 1;
 		entry->fp = NULL;
 		ZVAL_UNDEF(&entry->metadata_tracker.val);
+		entry->metadata_tracker.str = NULL;
 		entry->link = entry->tmp = NULL;
 		source = entry;
 
diff --git a/ext/phar/tests/gh25090.phpt b/ext/phar/tests/gh25090.phpt
new file mode 100644
index 000000000000..4860e5abfe5e
--- /dev/null
+++ b/ext/phar/tests/gh25090.phpt
@@ -0,0 +1,25 @@
+--TEST--
+GH-25090 (Use-after-free in phar_wrapper_rename() with entry metadata)
+--EXTENSIONS--
+phar
+--INI--
+phar.readonly=0
+--FILE--
+<?php
+$fname = __DIR__ . '/gh25090.phar';
+$phar = new Phar($fname);
+$phar['a'] = 'x';
+$phar['a']->setMetadata(['k' => 'v']);
+rename('phar://' . $fname . '/a', 'phar://' . $fname . '/b');
+$phar['c'] = 'y';
+var_dump($phar['b']->getMetadata());
+?>
+--CLEAN--
+<?php
+@unlink(__DIR__ . '/gh25090.phar');
+?>
+--EXPECT--
+array(1) {
+  ["k"]=>
+  string(1) "v"
+}