phar: Fix double-free in webPhar() without PATH_INFO

In the CGI/FastCGI branch of webPhar(), when SCRIPT_NAME is present but
PATH_INFO is absent, path_info was aliased to the testit buffer and
free_pathinfo was set. Since commit 3ee2f44 added an unconditional
efree(testit) after that branch, path_info became a dangling pointer.
This causes a use-after-free when path_info is read later and a
double-free at the cleanup_skip_entry label where free_pathinfo triggers
efree(path_info).

This only affects PHP-8.6 as earlier branches do not free testit there.

Allocate a dedicated copy for path_info so its lifetime outlives the
efree(testit).

Reported by RigelYoung.

Closes GH-24166

Author: bukka

ext/phar/phar_object.c

@@ -665,7 +665,7 @@ PHP_METHOD(Phar, webPhar)
 				spprintf(&path_info, 0, "%s%s", testit, path_info);
 				free_pathinfo = 1;
 			} else {
-				path_info = testit;
+				path_info = estrdup(testit);
 				free_pathinfo = 1;
 				entry = estrndup("", 0);
 				entry_len = 0;

ext/phar/tests/webphar_cgi_no_path_info.phpt

@@ -0,0 +1,31 @@
+--TEST--
+Phar::webPhar() double free in CGI when SCRIPT_NAME is set but PATH_INFO is absent
+--CGI--
+--EXTENSIONS--
+phar
+--INI--
+phar.readonly=0
+phar.require_hash=0
+variables_order=EGPC
+register_argc_argv=0
+cgi.fix_pathinfo=0
+--ENV--
+REQUEST_METHOD=GET
+SCRIPT_NAME=/webphar_cgi_no_path_info.phar
+--FILE--
+<?php
+$fname = __DIR__ . '/' . basename(__FILE__, '.php') . '.phar';
+$phar = new Phar($fname);
+$phar->addFromString('index.php', '<?php echo "ok\n"; ?>');
+$phar->setStub('<?php
+Phar::webPhar();
+__HALT_COMPILER(); ?>');
+unset($phar);
+include $fname;
+?>
+--CLEAN--
+<?php @unlink(__DIR__ . '/' . basename(__FILE__, '.clean.php') . '.phar'); ?>
+--EXPECTHEADERS--
+Status: 301 Moved Permanently
+Location: /webphar_cgi_no_path_info.phar/index.php
+--EXPECT--