Merge branch 'PHP-8.4' into PHP-8.5

* PHP-8.4:
  Fix GH-20732: Phar::LoadPhar undefined behavior when loading directory

NEWS

@@ -30,6 +30,10 @@ PHP                                                                        NEWS
   . Fixed bug GH-20674 (Fix GH-20674 mb_decode_mimeheader does not handle
     separator). (Yuya Hamada)
 
+- Phar:
+  . Fixed bug GH-20732 (Phar::LoadPhar undefined behavior when reading fails).
+    (ndossche)
+
 - Sqlite3:
   . Fixed bug GH-20699 (SQLite3Result fetchArray return array|false,
     null returned). (ndossche, plusminmax)

ext/phar/phar.c

@@ -1619,7 +1619,7 @@ static zend_result phar_open_from_fp(php_stream* fp, char *fname, size_t fname_l
 	const zend_long readsize = sizeof(buffer) - sizeof(token);
 	const zend_long tokenlen = sizeof(token) - 1;
 	zend_long halt_offset;
-	size_t got;
+	ssize_t got;
 	uint32_t compression = PHAR_FILE_COMPRESSED_NONE;
 
 	if (error) {
@@ -1637,7 +1637,7 @@ static zend_result phar_open_from_fp(php_stream* fp, char *fname, size_t fname_l
 	/* Maybe it's better to compile the file instead of just searching,  */
 	/* but we only want the offset. So we want a .re scanner to find it. */
 	while(!php_stream_eof(fp)) {
-		if ((got = php_stream_read(fp, buffer+tokenlen, readsize)) < (size_t) tokenlen) {
+		if ((got = php_stream_read(fp, buffer+tokenlen, readsize)) < tokenlen) {
 			MAPPHAR_ALLOC_FAIL("internal corruption of phar \"%s\" (truncated entry)")
 		}
 

ext/phar/tests/gh20732.phpt

@@ -0,0 +1,14 @@
+--TEST--
+GH-20732 (Phar::LoadPhar undefined behavior when loading directory)
+--EXTENSIONS--
+phar
+--FILE--
+<?php
+try {
+    @Phar::LoadPhar('.');
+} catch (PharException $e) {
+    echo $e->getMessage(), "\n";
+}
+?>
+--EXPECTF--
+%r(internal corruption of phar "%s" \(truncated entry\)|unable to open phar for reading ".")%r