From 11f3ded074f0cf5f2683196f737185a231389dfa Mon Sep 17 00:00:00 2001
From: lazerg <lazerg2@gmail.com>
Date: Sat, 7 Nov 2026 12:01:25 -0500
Subject: [PATCH] Fix GH-25267: NULL dereference in to_xml_any() with integer
 key

to_xml_any() renamed each output node after its array key, but an integer
key has no zend_string, so ZSTR_VAL() dereferenced NULL. Rename only for
string keys, as to_xml_object() does, so an integer-keyed element keeps its
default name.

Fixes GH-25267
Closes GH-25270
---
 NEWS                        |  4 ++++
 ext/soap/php_encoding.c     |  2 +-
 ext/soap/tests/gh25267.phpt | 20 ++++++++++++++++++++
 3 files changed, 25 insertions(+), 1 deletion(-)
 create mode 100644 ext/soap/tests/gh25267.phpt

diff --git a/NEWS b/NEWS
index 2d3e9d00d30d..668b5898c62c 100644
--- a/NEWS
+++ b/NEWS
@@ -25,6 +25,10 @@ PHP                                                                        NEWS
   . Fixed bug GH-16396 (Failed to invoke user error handler during index
     conversion in JIT). (Jorg Sowa)
 
+- SOAP:
+  . Fixed bug GH-25267 (NULL dereference in to_xml_any() with integer key).
+    (lazerg)
+
 - Streams:
   . Fixed bug GH-22063 (Stream filter chain UAF on self-removal during
     callback). (Ilia Alshanetsky)
diff --git a/ext/soap/php_encoding.c b/ext/soap/php_encoding.c
index 8fc429ffe255..56317abf4ab7 100644
--- a/ext/soap/php_encoding.c
+++ b/ext/soap/php_encoding.c
@@ -3237,7 +3237,7 @@ static xmlNodePtr to_xml_any(encodeTypePtr type, zval *data, int style, xmlNodeP
 
 		ZEND_HASH_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(data), name, el) {
 			ret = master_to_xml(enc, el, style, parent);
-		    if (ret &&
+		    if (ret && name &&
 		        ret->name != xmlStringTextNoenc) {
 				xmlNodeSetName(ret, BAD_CAST(ZSTR_VAL(name)));
 		    }
diff --git a/ext/soap/tests/gh25267.phpt b/ext/soap/tests/gh25267.phpt
new file mode 100644
index 000000000000..c67411828d18
--- /dev/null
+++ b/ext/soap/tests/gh25267.phpt
@@ -0,0 +1,20 @@
+--TEST--
+GH-25267 (NULL zend_string dereference in to_xml_any with integer key)
+--EXTENSIONS--
+soap
+--CREDITS--
+YuanchengJiang
+--FILE--
+<?php
+class C extends SoapClient {
+    function __doRequest($request, $location, $action, $version, $one_way = false, ?string $uriParserClass = null): string {
+        echo $request;
+        return "";
+    }
+}
+$c = new C(null, ["location" => "test://", "uri" => "test://"]);
+$c->foo(new SoapVar([new SoapVar("y", XSD_STRING), "a" => new SoapVar("x", XSD_STRING)], XSD_ANYXML));
+?>
+--EXPECT--
+<?xml version="1.0" encoding="UTF-8"?>
+<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="test://" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><ns1:foo><BOGUS xsi:type="xsd:string">y</BOGUS><a xsi:type="xsd:string">x</a></ns1:foo></SOAP-ENV:Body></SOAP-ENV:Envelope>