Merge branch 'PHP-8.6'

* PHP-8.6:
  Fix GH-25091: UAF in phar rename() when source and destination are equal
  Fix GH-25090: UAF in phar rename() of an entry with metadata

Author: ndossche

ext/phar/stream.c

@@ -865,6 +865,11 @@ static int phar_wrapper_rename(php_stream_wrapper *wrapper, const char *url_from
 				url_from, url_to);
 			return 0;
 		}
+		if (zend_string_equals(resource_from->path, resource_to->path)) {
+			php_url_free(resource_from);
+			php_url_free(resource_to);
+			return 1;
+		}
 		/* transfer all data over to the new entry */
 		memcpy((void *) &new, (void *) entry, sizeof(phar_entry_info));
 		/* mark the old one for deletion */
@@ -873,6 +878,7 @@ static int phar_wrapper_rename(php_stream_wrapper *wrapper, const char *url_from
 		ZVAL_UNDEF(&entry->metadata_tracker.val);
 		entry->symlink = NULL;
 		entry->tmp = NULL;
+		entry->metadata_tracker.str = NULL;
 		source = entry;
 
 		/* add to the manifest, and then store the pointer to the new guy in entry

ext/phar/tests/gh25090.phpt

@@ -0,0 +1,25 @@
+--TEST--
+GH-25090 (Use-after-free in phar_wrapper_rename() with entry metadata)
+--EXTENSIONS--
+phar
+--INI--
+phar.readonly=0
+--FILE--
+<?php
+$fname = __DIR__ . '/gh25090.phar';
+$phar = new Phar($fname);
+$phar['a'] = 'x';
+$phar['a']->setMetadata(['k' => 'v']);
+rename('phar://' . $fname . '/a', 'phar://' . $fname . '/b');
+$phar['c'] = 'y';
+var_dump($phar['b']->getMetadata());
+?>
+--CLEAN--
+<?php
+@unlink(__DIR__ . '/gh25090.phar');
+?>
+--EXPECT--
+array(1) {
+  ["k"]=>
+  string(1) "v"
+}

ext/phar/tests/gh25091.phpt

@@ -0,0 +1,24 @@
+--TEST--
+GH-25091: Use-after-free in rename() when source and destination are the same entry
+--EXTENSIONS--
+phar
+--INI--
+phar.readonly=0
+--FILE--
+<?php
+$fname = __DIR__ . '/gh25091.phar';
+
+$phar = new Phar($fname);
+$phar['a'] = 'contents';
+unset($phar);
+
+var_dump(rename('phar://' . $fname . '/a', 'phar://' . $fname . '/a'));
+var_dump(file_get_contents('phar://' . $fname . '/a'));
+?>
+--CLEAN--
+<?php
+@unlink(__DIR__ . '/gh25091.phar');
+?>
+--EXPECT--
+bool(true)
+string(8) "contents"