Fix stream double free in phar

ext/phar/phar_object.c

@@ -2306,6 +2306,13 @@ static zend_object *phar_convert_to_other(phar_archive_data *source, int convert
 			/* exception already thrown */
 			return NULL;
 		}
+
+		if (newentry.fp == NULL) {
+			/* entry->fp may be moved to cfp in phar_copy_file_contents
+			 * and be free'd later in phar_flush_ex
+			 * If so, zero fp to avoid double free in rshutdown. */
+			entry->fp = NULL;
+		}
 no_copy:
 		newentry.filename = zend_string_copy(newentry.filename);
 

ext/phar/tests/gh18953.phpt

@@ -0,0 +1,45 @@
+--TEST--
+Phar: Stream double free
+--EXTENSIONS--
+phar
+--INI--
+phar.readonly=0
+--ENV--
+USE_ZEND_ALLOC=0
+--FILE--
+<?php
+
+declare(strict_types=1);
+
+require __DIR__ . '/gh18953/autoload.inc';
+
+// cleaning
+@unlink("gh18953.phar");
+@unlink("gh18953.phar.gz");
+
+// create a phar
+$phar = new Phar("gh18953.phar");
+$phar->startBuffering();
+// add any dir
+$phar->addEmptyDir("dir");
+$phar->stopBuffering();
+// compress
+$phar->compress(Phar::GZ);
+
+// this increases the chance of reproducing the problem
+// even with this, it's not always reproducible
+$obj1 = new NS1\Class1();
+$obj2 = new NS1\Class1();
+$obj2 = new NS1\Class1();
+$obj2 = new NS1\Class1();
+$obj2 = new NS1\Class1();
+
+echo "Done" . PHP_EOL;
+?>
+--CLEAN--
+<?php
+@unlink("gh18953.phar");
+@unlink("gh18953.phar.gz");
+?>
+--EXPECT--
+Done

ext/phar/tests/gh18953/autoload.inc

@@ -0,0 +1,10 @@
+<?php
+
+spl_autoload_register(function ($class) {
+    $base_dir = __DIR__ . '/src/';
+
+    $file = $base_dir . str_replace('\\', '/', $class) . '.inc';
+    if (file_exists($file)) {
+        require $file;
+    }
+});

ext/phar/tests/gh18953/src/NS1/Class1.inc

@@ -0,0 +1,11 @@
+<?php
+
+declare(strict_types=1);
+
+namespace NS1;
+
+use NS2\Interface1;
+
+class Class1 implements Interface1
+{
+}

ext/phar/tests/gh18953/src/NS2/Interface1.inc

@@ -0,0 +1,9 @@
+<?php
+
+declare(strict_types=1);
+
+namespace NS2;
+
+interface Interface1
+{
+}