From c0d85a31d23323fb4038210f0090adbef5b81bee Mon Sep 17 00:00:00 2001
From: Alessio Attilio <attilio.alessio@protonmail.com>
Date: Sun, 1 Nov 2026 10:50:00 +0100
Subject: [PATCH 1/2] Fix GH-25112 Phar CGI redirect target

---
 ext/phar/phar_object.c      | 21 ++++-----------------
 ext/phar/tests/gh25112.phpt | 33 +++++++++++++++++++++++++++++++++
 2 files changed, 37 insertions(+), 17 deletions(-)
 create mode 100644 ext/phar/tests/gh25112.phpt

diff --git a/ext/phar/phar_object.c b/ext/phar/phar_object.c
index 9d3bd842cb72..d951be204bef 100644
--- a/ext/phar/phar_object.c
+++ b/ext/phar/phar_object.c
@@ -557,7 +557,7 @@ PHP_METHOD(Phar, webPhar)
 	const char *basename;
 	size_t fname_len, index_php_len = 0;
 	size_t entry_len;
-	int code, not_cgi;
+	int code;
 	phar_archive_data *phar = NULL;
 	phar_entry_info *info = NULL;
 	size_t sapi_mod_name_len = strlen(sapi_module.name);
@@ -674,7 +674,6 @@ PHP_METHOD(Phar, webPhar)
 			pt = estrndup(testit, (pt - testit) + (fname_len - (basename - fname)));
 			efree(testit);
 		}
-		not_cgi = 0;
 	} else {
 		path_info = SG(request_info).request_uri;
 
@@ -689,7 +688,6 @@ PHP_METHOD(Phar, webPhar)
 		entry = estrndup(pt + (fname_len - (basename - fname)), entry_len);
 
 		pt = estrndup(path_info, (pt - path_info) + (fname_len - (basename - fname)));
-		not_cgi = 1;
 	}
 
 	if (ZEND_FCI_INITIALIZED(rewrite_fci)) {
@@ -758,29 +756,18 @@ PHP_METHOD(Phar, webPhar)
 		if (!phar || (info = phar_get_entry_info(phar, entry, entry_len, NULL, false)) == NULL) {
 			phar_do_404(phar, fname, fname_len, f404);
 		} else {
-			char *tmp = NULL, sa = '\0';
 			sapi_header_line ctr = {0};
 			ctr.response_code = 301;
 			ctr.line_len = sizeof("HTTP/1.1 301 Moved Permanently")-1;
 			ctr.line = "HTTP/1.1 301 Moved Permanently";
 			sapi_header_op(SAPI_HEADER_REPLACE, &ctr);
 
-			if (not_cgi) {
-				tmp = strstr(path_info, basename) + (fname_len - (basename - fname));
-				sa = *tmp;
-				*tmp = '\0';
-			}
-
 			ctr.response_code = 0;
 
-			if (path_info[strlen(path_info)-1] == '/') {
-				ctr.line_len = spprintf((char **) &(ctr.line), 4096, "Location: %s%s", path_info, entry + 1);
+			if (pt[strlen(pt)-1] == '/') {
+				ctr.line_len = spprintf((char **) &(ctr.line), 4096, "Location: %s%s", pt, entry + 1);
 			} else {
-				ctr.line_len = spprintf((char **) &(ctr.line), 4096, "Location: %s%s", path_info, entry);
-			}
-
-			if (not_cgi) {
-				*tmp = sa;
+				ctr.line_len = spprintf((char **) &(ctr.line), 4096, "Location: %s%s", pt, entry);
 			}
 
 			sapi_header_op(SAPI_HEADER_REPLACE, &ctr);
diff --git a/ext/phar/tests/gh25112.phpt b/ext/phar/tests/gh25112.phpt
new file mode 100644
index 000000000000..d7cb72351b8d
--- /dev/null
+++ b/ext/phar/tests/gh25112.phpt
@@ -0,0 +1,33 @@
+--TEST--
+GH-25112: Phar::webPhar() CGI redirect drops PATH_INFO after rewriting to the index
+--CGI--
+--EXTENSIONS--
+phar
+--INI--
+phar.readonly=0
+phar.require_hash=0
+variables_order=EGPC
+register_argc_argv=0
+cgi.fix_pathinfo=0
+--ENV--
+REQUEST_METHOD=GET
+REQUEST_URI=/sub/gh25112.phar/foo
+SCRIPT_NAME=/sub/gh25112.phar
+PATH_INFO=/foo
+--FILE--
+<?php
+$fname = __DIR__ . '/gh25112.phar';
+$phar = new Phar($fname);
+$phar->addFromString('index.php', '<?php echo "ok\n"; ?>');
+$phar->setStub('<?php
+Phar::webPhar(null, null, null, null, function ($path) { return "/"; });
+__HALT_COMPILER(); ?>');
+unset($phar);
+include $fname;
+?>
+--CLEAN--
+<?php @unlink(__DIR__ . '/gh25112.phar'); ?>
+--EXPECTHEADERS--
+Status: 301 Moved Permanently
+Location: /sub/gh25112.phar/index.php
+--EXPECT--

From 0fd6a34fdf7058de27c86bcd60f421ee27a799da Mon Sep 17 00:00:00 2001
From: Alessio Attilio <attilio.alessio@protonmail.com>
Date: Mon, 2 Nov 2026 22:14:20 +0100
Subject: [PATCH 2/2] Pass valid MIME types to Phar::webPhar test

---
 ext/phar/tests/gh25112.phpt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ext/phar/tests/gh25112.phpt b/ext/phar/tests/gh25112.phpt
index d7cb72351b8d..0ffdba1c8c7f 100644
--- a/ext/phar/tests/gh25112.phpt
+++ b/ext/phar/tests/gh25112.phpt
@@ -20,7 +20,7 @@ $fname = __DIR__ . '/gh25112.phar';
 $phar = new Phar($fname);
 $phar->addFromString('index.php', '<?php echo "ok\n"; ?>');
 $phar->setStub('<?php
-Phar::webPhar(null, null, null, null, function ($path) { return "/"; });
+Phar::webPhar(null, null, null, [], function ($path) { return "/"; });
 __HALT_COMPILER(); ?>');
 unset($phar);
 include $fname;