Repository navigation
Conversation
|
Independent confirmation that this fixes GH-25093. Built Base (unpatched) — FAIL, the redirect keeps the request path that was written past the file name: With the fix ( That matches the report: the terminator advanced by the full on-disk Full suites on the patched build (NTS,
Drafted with an LLM; I ran and verified the commands myself. |
opensource-fork-sync Bot
pushed a commit
to cla7aye15I4nd/opensource-php__php-src
that referenced
this pull request
Nov 2, 2026
* PHP-8.4: Fix phpGH-25093: Phar::webPhar() redirect reads past the request URI (php#25102)
arnaud-lb
added a commit
to marc-mabe/php-src
that referenced
this pull request
Nov 2, 2026
* PHP-8.6: (158 commits) Fix ZEND_LONG_UINT_OVFL() accepting negative values on 32-bit platforms (php#24778) Don't use static closure cache when called_scope diverges ext/com_dotnet: Fix phpGH-25008 event source typelib crash Fix phpGH-25093: Phar::webPhar() redirect reads past the request URI (php#25102) Fix the WSAPoll backend of Io\Poll accepting handles that are not sockets Fix phpGH-25086: Io\Poll kqueue backend leaks memory on every modifyEvents() (php#25087) openssl: Fix heap buffer overflow in TLS PSK callbacks openssl: Fix use-after-free in TLS session remove callback [`%pS` migration] Use `%pS` in ext/standard/var.c [`%pS` migration] Use `%pS` in ext/standard/var_unserializer.re [`%pS` migration] Use `%pS` in ext/standard/string.c [`%pS` migration] Use `%pS` in ext/standard/streamsfuncs.c [`%pS` migration] Use `%pS` in ext/standard/proc_open.c [`%pS` migration] Use `%pS` in ext/standard/mail.c [`%pS` migration] Use `%pS` in ext/standard/info.c [`%pS` migration] Use `%pS` in ext/standard/http.c [`%pS` migration] Use `%pS` in ext/standard/http_fopen_wrapper.c [`%pS` migration] Use `%pS` in ext/standard/head.c [`%pS` migration] Use `%pS` in ext/standard/ftp_fopen_wrapper.c [`%pS` migration] Use `%pS` in ext/standard/fsock.c ...
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On non-CGI SAPIs the 301 redirect for a direct request cut the request URI at
strstr(path_info, basename) + fname_len, butfname_lenis the length of the full phar path, not of its basename. That pointer lands past the end of the URI (or in the wrong place when a rewrite callback returns/), so it now advances by the basename length like the code that buildsptalready does.Fixes #25093