From 25b8693acd745175d04979a6a0b7008e9f6c287e Mon Sep 17 00:00:00 2001
From: lazerg <lazerg2@gmail.com>
Date: Sat, 31 Oct 2026 22:32:36 +0500
Subject: [PATCH 1/2] Fix GH-25093: Phar::webPhar() redirect reads past the
 request URI

---
 ext/phar/phar_object.c      |  2 +-
 ext/phar/tests/gh25093.phpt | 42 +++++++++++++++++++++++++++++++++++++
 2 files changed, 43 insertions(+), 1 deletion(-)
 create mode 100644 ext/phar/tests/gh25093.phpt

diff --git a/ext/phar/phar_object.c b/ext/phar/phar_object.c
index e2f36f1c7b24..cb071f0ca300 100644
--- a/ext/phar/phar_object.c
+++ b/ext/phar/phar_object.c
@@ -784,7 +784,7 @@ PHP_METHOD(Phar, webPhar)
 			sapi_header_op(SAPI_HEADER_REPLACE, &ctr);
 
 			if (not_cgi) {
-				tmp = strstr(path_info, basename) + fname_len;
+				tmp = strstr(path_info, basename) + (fname_len - (basename - fname));
 				sa = *tmp;
 				*tmp = '\0';
 			}
diff --git a/ext/phar/tests/gh25093.phpt b/ext/phar/tests/gh25093.phpt
new file mode 100644
index 000000000000..c0a3fde5a7c1
--- /dev/null
+++ b/ext/phar/tests/gh25093.phpt
@@ -0,0 +1,42 @@
+--TEST--
+GH-25093: Phar::webPhar() redirect uses the full phar path length to cut the request URI
+--EXTENSIONS--
+phar
+--SKIPIF--
+<?php
+if (!file_exists(__DIR__ . "/../../../sapi/cli/tests/php_cli_server.inc")) {
+    echo "skip sapi/cli/tests/php_cli_server.inc required but not found";
+}
+?>
+--CONFLICTS--
+server
+--INI--
+phar.readonly=0
+phar.require_hash=0
+--FILE--
+<?php
+include __DIR__ . "/../../../sapi/cli/tests/php_cli_server.inc";
+
+$info = php_cli_server_start('include __DIR__ . "/gh25093.phar";', 'router.php');
+
+$phar = new Phar($info->docRoot . '/gh25093.phar');
+$phar->addFromString('index.php', '<?php echo "index\n";');
+$phar->setStub('<?php
+Phar::webPhar(null, "index.php", null, [], function ($path) {
+    return "/";
+});
+__HALT_COMPILER(); ?>');
+unset($phar);
+
+$context = stream_context_create(['http' => ['follow_location' => 0]]);
+$uri = '/gh25093.phar/' . str_repeat('a', strlen($info->docRoot) + 32);
+file_get_contents('http://' . PHP_CLI_SERVER_ADDRESS . $uri, false, $context);
+
+foreach ($http_response_header as $header) {
+    if (str_starts_with($header, 'Location: ')) {
+        echo $header, "\n";
+    }
+}
+?>
+--EXPECT--
+Location: /gh25093.phar/index.php

From 51c06a7256a029f3b7fcbe1f83e994582a0d1b33 Mon Sep 17 00:00:00 2001
From: lazerg <lazerg2@gmail.com>
Date: Sat, 31 Oct 2026 22:44:04 +0500
Subject: [PATCH 2/2] Load phar in the test server and avoid
 $http_response_header

---
 ext/phar/tests/gh25093.phpt | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/ext/phar/tests/gh25093.phpt b/ext/phar/tests/gh25093.phpt
index c0a3fde5a7c1..442a95e63c7a 100644
--- a/ext/phar/tests/gh25093.phpt
+++ b/ext/phar/tests/gh25093.phpt
@@ -1,5 +1,5 @@
 --TEST--
-GH-25093: Phar::webPhar() redirect uses the full phar path length to cut the request URI
+GH-25093: Phar::webPhar() redirect reads past the request URI
 --EXTENSIONS--
 phar
 --SKIPIF--
@@ -17,7 +17,12 @@ phar.require_hash=0
 <?php
 include __DIR__ . "/../../../sapi/cli/tests/php_cli_server.inc";
 
-$info = php_cli_server_start('include __DIR__ . "/gh25093.phar";', 'router.php');
+$args = ["-d", "extension_dir=" . ini_get("extension_dir"), "-d", "extension=" . (substr(PHP_OS, 0, 3) == "WIN" ? "php_" : "") . "phar." . PHP_SHLIB_SUFFIX];
+if (php_ini_loaded_file()) {
+  $args[] = "-c";
+  $args[] = php_ini_loaded_file();
+}
+$info = php_cli_server_start('include __DIR__ . "/gh25093.phar";', 'router.php', $args);
 
 $phar = new Phar($info->docRoot . '/gh25093.phar');
 $phar->addFromString('index.php', '<?php echo "index\n";');
@@ -32,7 +37,7 @@ $context = stream_context_create(['http' => ['follow_location' => 0]]);
 $uri = '/gh25093.phar/' . str_repeat('a', strlen($info->docRoot) + 32);
 file_get_contents('http://' . PHP_CLI_SERVER_ADDRESS . $uri, false, $context);
 
-foreach ($http_response_header as $header) {
+foreach (http_get_last_response_headers() as $header) {
     if (str_starts_with($header, 'Location: ')) {
         echo $header, "\n";
     }