When session.cookie_lifetime was set to a value larger than maxcookie,
OnUpdateCookieLifetime returned SUCCESS without updating the internal
long value, causing ini_get() string and PS(cookie_lifetime) to go
out of sync.

We now properly parse the string value of the ini setting and fail when it is not an integer string or is not within the expected range.

phar_intercept_functions_init hooks 22 built-in functions via
PHAR_INTERCEPT. phar_intercept_functions_shutdown restores all of them
via PHAR_RELEASE except is_link, which was simply missing from the list.

On MSHUTDOWN the is_link entry in CG(function_table) retains the phar
intercept handler. In a persistent SAPI, if the module is reloaded, the
second MINIT saves PHP_FN(phar_is_link) as orig_is_link, and any
subsequent is_link() call recurses infinitely.

Closes GH-21800

In the CGI/FastCGI branch of webPhar(), sapi_getenv("SCRIPT_NAME") can return NULL when the upstream server doesn't forward SCRIPT_NAME in the FastCGI params block. The return value was passed directly to strstr() without a NULL check, causing a segfault.

Add a NULL guard that jumps to the finish: label, which is already used for the "SCRIPT_NAME doesn't match the phar basename" case. The fix matches the intent of the existing strstr check and requires no new cleanup.

Closes GH-21797
Closes GH-21802

Phar::offsetGet() calls phar_get_entry_info_dir with allow_dir=1, which
may return a heap-allocated temporary directory entry (is_temp_dir=1)
for paths that resolve to a virtual directory in the manifest. Three
early-exit paths for .phar/stub.php, .phar/alias.txt, and the generic
.phar/* prefix all called RETURN_THROWS() before the is_temp_dir cleanup
block, leaking the entry and its filename buffer on every rejection.

Move the is_temp_dir cleanup before the .phar/* guards so all exit paths
release the temporary entry regardless of which rejection fires.

Closes GH-21798

…r paths

phar_add_file opens or creates an entry via phar_get_or_create_entry_data_rw,
which increments the entry's reference count and must be balanced by a
phar_entry_delref call. Two error paths inside the content-write block
jumped to finish: with goto, skipping the phar_entry_delref at line 3714.
The finish: label comes after the delref, so both paths leaked the entry
reference.

Add phar_entry_delref(data) before each goto finish in the short-write and
missing-resource branches.

Closes GH-21798
Closes GH-21803

phar_stream_close called phar_stream_flush but discarded its int return
value, always returning 0 from the stream close operation. On a write-
modified phar entry, a flush failure (e.g. disk full during archive
commit) was silently ignored.

Capture the flush result and return it so the stream layer gets an
accurate close status.

Closes GH-21799
Closes GH-21804

…nvalid

Closes GH-21750

* PHP-8.4:
  Update NEWS for recent bug fixes
  ext/phar: Fix memory leak in phar_verify_signature() when md_ctx is invalid
  phar: propagate phar_stream_flush return value from phar_stream_close
  phar: call phar_entry_delref before goto finish in phar_add_file error paths
  phar: free is_temp_dir entry before rejecting .phar/* paths in offsetGet
  phar: fix NULL dereference in Phar::webPhar() when SCRIPT_NAME is absent
  phar: restore is_link handler in phar_intercept_functions_shutdown

* PHP-8.5:
  Update NEWS for recent bug fixes
  ext/phar: Fix memory leak in phar_verify_signature() when md_ctx is invalid
  phar: propagate phar_stream_flush return value from phar_stream_close
  phar: call phar_entry_delref before goto finish in phar_add_file error paths
  phar: free is_temp_dir entry before rejecting .phar/* paths in offsetGet
  phar: fix NULL dereference in Phar::webPhar() when SCRIPT_NAME is absent
  phar: restore is_link handler in phar_intercept_functions_shutdown

…root/rootrem and shift/pow operators.

Applies the gmp_fact() pattern (0236667) to the remaining
zend_long -> gmp_ulong casts that could silently overflow on
LLP64 platforms.

gmp_powm() switches to zend_argument_error() with the correct
argument index ($modulus) for modulo-by-zero.

close GH-21812

* PHP-8.2:
  [skip ci] Backport CI changes

* PHP-8.3:
  [skip ci] Backport CI changes

* PHP-8.4:
  [skip ci] Backport CI changes

* PHP-8.5:
  [skip ci] Backport CI changes