Sign extension at phar_object.c
Author: PavlNekrasovCreated Sep 17, 2026Updated Sep 17, 2026
LabelsBugStatus: Needs Triage
Description
The field compressed_filesize is a uint32_t, but PharFileInfo::getCompressedSize() returns it with RETURN_LONG: https://github.com/php/php-src/blob/fca72841a5d41b11c0e60ed0906af6af302741ca/ext/phar/phar_object.c#L4497 zend_long is 32-bit on 32-bit platforms: https://github.com/php/php-src/blob/fca72841a5d41b11c0e60ed0906af6af302741ca/Zend/zend_long.h#L41-L49 so a size above INT32_MAX is reported as a negative number.
Found by Linux Verification Center (portal.linuxtesting.ru) with SVACE.
Reporter: Pavel Nekrasov ([email protected]).
PHP Version
php version - 8.3Operating System
No response
Source: php/php-src