diff --git a/NEWS b/NEWS index 2d3e9d00d30d..668b5898c62c 100644 --- a/NEWS +++ b/NEWS @@ -25,6 +25,10 @@ PHP NEWS . Fixed bug GH-16396 (Failed to invoke user error handler during index conversion in JIT). (Jorg Sowa) +- SOAP: + . Fixed bug GH-25267 (NULL dereference in to_xml_any() with integer key). + (lazerg) + - Streams: . Fixed bug GH-22063 (Stream filter chain UAF on self-removal during callback). (Ilia Alshanetsky) diff --git a/ext/soap/php_encoding.c b/ext/soap/php_encoding.c index 8fc429ffe255..56317abf4ab7 100644 --- a/ext/soap/php_encoding.c +++ b/ext/soap/php_encoding.c @@ -3237,7 +3237,7 @@ static xmlNodePtr to_xml_any(encodeTypePtr type, zval *data, int style, xmlNodeP ZEND_HASH_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(data), name, el) { ret = master_to_xml(enc, el, style, parent); - if (ret && + if (ret && name && ret->name != xmlStringTextNoenc) { xmlNodeSetName(ret, BAD_CAST(ZSTR_VAL(name))); } diff --git a/ext/soap/tests/gh25267.phpt b/ext/soap/tests/gh25267.phpt new file mode 100644 index 000000000000..c67411828d18 --- /dev/null +++ b/ext/soap/tests/gh25267.phpt @@ -0,0 +1,20 @@ +--TEST-- +GH-25267 (NULL zend_string dereference in to_xml_any with integer key) +--EXTENSIONS-- +soap +--CREDITS-- +YuanchengJiang +--FILE-- + "test://", "uri" => "test://"]); +$c->foo(new SoapVar([new SoapVar("y", XSD_STRING), "a" => new SoapVar("x", XSD_STRING)], XSD_ANYXML)); +?> +--EXPECT-- + +yx