From 913945c269e61378af4ea2dd3b89e3ae7915476f Mon Sep 17 00:00:00 2001
From: Georgij Tsarin <68424751+crystarm@users.noreply.github.com>
Date: Thu, 2 Jul 2026 17:42:19 +0300
Subject: [PATCH] ext/phar: add upper-bound check on LongLink entry size

---
 NEWS           | 4 ++++
 ext/phar/tar.c | 6 ++++--
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/NEWS b/NEWS
index 439f7c83f2c1..046af289418b 100644
--- a/NEWS
+++ b/NEWS
@@ -153,6 +153,10 @@ PHP                                                                        NEWS
   . Fixed bug GH-23758 (PDO_Firebird returns null for non-null empty BLOBs).
     (Lazizbek Ergashev)
 
+- Phar:
+  . Fixed bug GH-22556 (OOM DoS via oversized ././@LongLink entry in TAR phar).
+    (crystarm)
+
 - Readline:
   . Fixed a heap over-read in the interactive shell prompt when cli.prompt is
     set to an empty string. (Ilia Alshanetsky)
diff --git a/ext/phar/tar.c b/ext/phar/tar.c
index 1f0c3a472750..fd129613fc24 100644
--- a/ext/phar/tar.c
+++ b/ext/phar/tar.c
@@ -435,8 +435,10 @@ zend_result phar_parse_tarfile(php_stream* fp, char *fname, size_t fname_len, ch
 			/* support the ././@LongLink system for storing long filenames */
 			entry.filename_len = entry.uncompressed_filesize;
 
-			/* Check for overflow - bug 61065 */
-			if (entry.filename_len == 0 || entry.filename_len > totalsize) {
+			/* Check for empty, truncated, or excessively large ././@LongLink filename entries - bug 61065 */
+			if (entry.filename_len == 0
+					|| entry.filename_len > totalsize
+					|| entry.filename_len > UINT16_MAX) {
 				if (error) {
 					spprintf(error, 4096, "phar error: \"%s\" is a corrupted tar file (invalid entry size)", fname);
 				}