Phar truncates entries of 4 GiB or more without error/warning #25053

Description

Adding a file of 4 GiB or more to a phar, tar or zip archive succeeds without any warning, but the archive stores the size and file truncated to 2^32 bytes.

The following code:

<?php
$dir = sys_get_temp_dir() . '/phar-4g';
@mkdir($dir);
$src = "$dir/big";
$f = fopen($src, 'w');
ftruncate($f, 2**32 + 1);  // file of 4 GiB + 1 byte
fclose($f);

@unlink("$dir/out.tar");
$tar = new PharData("$dir/out.tar");
$tar->addFile($src, 'big');

var_dump(filesize("$dir/out.tar"));
var_dump((new PharData("$dir/out.tar"))['big']->getSize());

Resulted in this output:

int(2048)
int(1)

I would expect it to either raise an exception (unsupported feature) or produce an archive the 4 GiB + 1 file and its contents.

The same happens with Phar::ZIP and with the phar format, and with buildFromDirectory() instead of addFile(). In every case the entry ends up 1 byte long.

The cause is that phar_entry_info stores the sizes as uint32_t:

and the lengths are assigned to them without a check

PHP Version

PHP 8.7.0-dev master at 8ab2340b8e20

Operating System

No response