From 4569f8680e911428be65066f4f96cf8ebd1b3371 Mon Sep 17 00:00:00 2001
From: lazerg <lazerg2@gmail.com>
Date: Sat, 31 Oct 2026 22:22:44 +0500
Subject: [PATCH 1/2] Fix GH-25089: Heap buffer over-read via crafted alias
 size in zip-based phar

---
 ext/phar/tests/zip/gh25089.phpt | 30 ++++++++++++++++++++++++++++++
 ext/phar/zip.c                  |  3 ++-
 2 files changed, 32 insertions(+), 1 deletion(-)
 create mode 100644 ext/phar/tests/zip/gh25089.phpt

diff --git a/ext/phar/tests/zip/gh25089.phpt b/ext/phar/tests/zip/gh25089.phpt
new file mode 100644
index 000000000000..73708a82f9ae
--- /dev/null
+++ b/ext/phar/tests/zip/gh25089.phpt
@@ -0,0 +1,30 @@
+--TEST--
+GH-25089 (Heap buffer over-read via crafted alias size in zip-based phar)
+--EXTENSIONS--
+phar
+zlib
+--FILE--
+<?php
+$name = '.phar/alias.txt';
+$alias = 'ABCD';
+$data = gzdeflate($alias);
+$crc = crc32($alias);
+$claimed = 0x1000;
+
+$local = "PK\x03\x04" . pack('vvvvvVVVvv', 20, 0, 8, 0, 0, $crc, strlen($data), $claimed, strlen($name), 0)
+    . $name . $data;
+$central = "PK\x01\x02" . pack('vvvvvvVVVvvvvvVV', 20, 20, 0, 8, 0, 0, $crc, strlen($data), $claimed, strlen($name), 0, 0, 0, 0, 0, 0)
+    . $name;
+$end = "PK\x05\x06" . pack('vvvvVVv', 0, 0, 1, 1, strlen($central), strlen($local), 0);
+
+file_put_contents(__DIR__ . '/gh25089.zip', $local . $central . $end);
+
+$phar = new PharData(__DIR__ . '/gh25089.zip');
+var_dump($phar->getAlias());
+?>
+--CLEAN--
+<?php
+@unlink(__DIR__ . '/gh25089.zip');
+?>
+--EXPECT--
+string(4) "ABCD"
diff --git a/ext/phar/zip.c b/ext/phar/zip.c
index f051c35a09a7..c1230cb78079 100644
--- a/ext/phar/zip.c
+++ b/ext/phar/zip.c
@@ -648,7 +648,6 @@ int phar_parse_zipfile(php_stream *fp, char *fname, size_t fname_len, char *alia
 			fp->readpos = 0;
 			/* the above lines should be for php < 5.2.6 after 5.3 filters are fixed */
 
-			mydata->alias_len = entry.uncompressed_filesize;
 			if (entry.flags & PHAR_ENT_COMPRESSED_GZ) {
 				filter = php_stream_filter_create("zlib.inflate", NULL, php_stream_is_persistent(fp));
 
@@ -735,6 +734,8 @@ int phar_parse_zipfile(php_stream *fp, char *fname, size_t fname_len, char *alia
 				}
 			}
 
+			mydata->alias_len = entry.uncompressed_filesize;
+
 			/* return to central directory parsing */
 			php_stream_seek(fp, restore_pos, SEEK_SET);
 		}

From 3262ce1d0cf4d0c612ff627a52ecfc4026667a3c Mon Sep 17 00:00:00 2001
From: lazerg <lazerg2@gmail.com>
Date: Sat, 31 Oct 2026 22:33:47 +0500
Subject: [PATCH 2/2] Wrap long lines in gh25089.phpt

---
 ext/phar/tests/zip/gh25089.phpt | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/ext/phar/tests/zip/gh25089.phpt b/ext/phar/tests/zip/gh25089.phpt
index 73708a82f9ae..ec68c035f0c4 100644
--- a/ext/phar/tests/zip/gh25089.phpt
+++ b/ext/phar/tests/zip/gh25089.phpt
@@ -11,11 +11,16 @@ $data = gzdeflate($alias);
 $crc = crc32($alias);
 $claimed = 0x1000;
 
-$local = "PK\x03\x04" . pack('vvvvvVVVvv', 20, 0, 8, 0, 0, $crc, strlen($data), $claimed, strlen($name), 0)
+$local = "PK\x03\x04"
+    . pack('vvvvvVVVvv', 20, 0, 8, 0, 0,
+        $crc, strlen($data), $claimed, strlen($name), 0)
     . $name . $data;
-$central = "PK\x01\x02" . pack('vvvvvvVVVvvvvvVV', 20, 20, 0, 8, 0, 0, $crc, strlen($data), $claimed, strlen($name), 0, 0, 0, 0, 0, 0)
+$central = "PK\x01\x02"
+    . pack('vvvvvvVVVvvvvvVV', 20, 20, 0, 8, 0, 0,
+        $crc, strlen($data), $claimed, strlen($name), 0, 0, 0, 0, 0, 0)
     . $name;
-$end = "PK\x05\x06" . pack('vvvvVVv', 0, 0, 1, 1, strlen($central), strlen($local), 0);
+$end = "PK\x05\x06"
+    . pack('vvvvVVv', 0, 0, 1, 1, strlen($central), strlen($local), 0);
 
 file_put_contents(__DIR__ . '/gh25089.zip', $local . $central . $end);