From 45d33c15848c19f6636efd4e22ef6761d1f9aca1 Mon Sep 17 00:00:00 2001
From: lazerg <lazerg2@gmail.com>
Date: Tue, 27 Oct 2026 17:07:48 +0500
Subject: [PATCH] Fix GH-24740: Unbounded size of .phar/.metadata* entry in TAR
 phar

---
 ext/phar/tar.c                  |  2 +-
 ext/phar/tests/tar/gh24740.phpt | 44 +++++++++++++++++++++++++++++++++
 2 files changed, 45 insertions(+), 1 deletion(-)
 create mode 100644 ext/phar/tests/tar/gh24740.phpt

diff --git a/ext/phar/tar.c b/ext/phar/tar.c
index 1f0c3a472750..198f157ca1fd 100644
--- a/ext/phar/tar.c
+++ b/ext/phar/tar.c
@@ -588,7 +588,7 @@ zend_result phar_parse_tarfile(php_stream* fp, char *fname, size_t fname_len, ch
 		}
 
 		if (entry.filename_len >= sizeof(".phar/.metadata")-1 && !memcmp(entry.filename, ".phar/.metadata", sizeof(".phar/.metadata")-1)) {
-			if (FAILURE == phar_tar_process_metadata(newentry, fp)) {
+			if (size > totalsize || FAILURE == phar_tar_process_metadata(newentry, fp)) {
 				if (error) {
 					spprintf(error, 4096, "phar error: tar-based phar \"%s\" has invalid metadata in magic file \"%s\"", fname, entry.filename);
 				}
diff --git a/ext/phar/tests/tar/gh24740.phpt b/ext/phar/tests/tar/gh24740.phpt
new file mode 100644
index 000000000000..e42a38567d10
--- /dev/null
+++ b/ext/phar/tests/tar/gh24740.phpt
@@ -0,0 +1,44 @@
+--TEST--
+GH-24740 (Unbounded size of .phar/.metadata* entry in TAR phar)
+--EXTENSIONS--
+phar
+--INI--
+memory_limit=16M
+--FILE--
+<?php
+function tar_header(string $name, int $size): string
+{
+    $header = str_repeat("\0", 512);
+    $header = substr_replace($header, $name, 0, strlen($name));
+    $header = substr_replace($header, sprintf("%07o\0", 0644), 100, 8);
+    $header = substr_replace($header, sprintf("%07o\0", 0), 108, 8);
+    $header = substr_replace($header, sprintf("%07o\0", 0), 116, 8);
+    $header = substr_replace($header, sprintf("%011o\0", $size), 124, 12);
+    $header = substr_replace($header, sprintf("%011o\0", 1700000000), 136, 12);
+    $header[156] = '0';
+    $header = substr_replace($header, "ustar\0", 257, 6);
+    $header = substr_replace($header, "00", 263, 2);
+
+    $checksum = 0;
+    for ($i = 0; $i < 512; $i++) {
+        $checksum += ($i >= 148 && $i < 156) ? 0x20 : ord($header[$i]);
+    }
+
+    return substr_replace($header, sprintf("%06o\0 ", $checksum), 148, 8);
+}
+
+$fname = __DIR__ . '/gh24740.tar';
+file_put_contents($fname, tar_header('.phar/.metadata.bin', 0x7FFFFE00) . str_repeat("\0", 1024));
+
+try {
+    new PharData($fname);
+} catch (UnexpectedValueException $e) {
+    echo $e->getMessage(), "\n";
+}
+?>
+--CLEAN--
+<?php
+@unlink(__DIR__ . '/gh24740.tar');
+?>
+--EXPECTF--
+phar error: tar-based phar "%sgh24740.tar" has invalid metadata in magic file ".phar/.metadata.bin"