From 7f1e77feeb3648c52d887fb8f2f488e84d4e4a1d Mon Sep 17 00:00:00 2001
From: lazerg <lazerg2@gmail.com>
Date: Sun, 8 Nov 2026 19:13:49 +0500
Subject: [PATCH 1/2] Fix GH-25303: NULL encoder dereference in to_xml_list()
 error message

---
 ext/soap/php_encoding.c     |  4 ++--
 ext/soap/tests/gh25303.phpt | 36 ++++++++++++++++++++++++++++++++++++
 2 files changed, 38 insertions(+), 2 deletions(-)
 create mode 100644 ext/soap/tests/gh25303.phpt

diff --git a/ext/soap/php_encoding.c b/ext/soap/php_encoding.c
index 8d869b6705dd..9afd93b7625c 100644
--- a/ext/soap/php_encoding.c
+++ b/ext/soap/php_encoding.c
@@ -3117,7 +3117,7 @@ static xmlNodePtr to_xml_list(encodeTypePtr enc, zval *data, int style, xmlNodeP
 			} else {
 				soap_error2(E_ERROR,
 					"Encoding: Failed to encode list item of type '%s' for list type '%s'",
-					soap_type_name(&list_enc->details), soap_type_name(enc));
+					soap_type_name(list_enc ? &list_enc->details : NULL), soap_type_name(enc));
 			}
 			xmlUnlinkNode(dummy);
 			xmlFreeNode(dummy);
@@ -3161,7 +3161,7 @@ static xmlNodePtr to_xml_list(encodeTypePtr enc, zval *data, int style, xmlNodeP
 			} else {
 				soap_error2(E_ERROR,
 					"Encoding: Failed to encode list item of type '%s' for list type '%s'",
-					soap_type_name(&list_enc->details), soap_type_name(enc));
+					soap_type_name(list_enc ? &list_enc->details : NULL), soap_type_name(enc));
 			}
 			xmlUnlinkNode(dummy);
 			xmlFreeNode(dummy);
diff --git a/ext/soap/tests/gh25303.phpt b/ext/soap/tests/gh25303.phpt
new file mode 100644
index 000000000000..3a38b9f57b24
--- /dev/null
+++ b/ext/soap/tests/gh25303.phpt
@@ -0,0 +1,36 @@
+--TEST--
+GH-25303 (NULL encode dereference in to_xml_list() error path for union types)
+--EXTENSIONS--
+soap
+--CREDITS--
+YuanchengJiang
+--FILE--
+<?php
+$wsdl = <<<XML
+<definitions xmlns="http://schemas.xmlsoap.org/wsdl/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/"
+    xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:tns="urn:t" targetNamespace="urn:t">
+  <types>
+    <xsd:schema targetNamespace="urn:t">
+      <xsd:simpleType name="U"><xsd:union memberTypes="xsd:int"/></xsd:simpleType>
+    </xsd:schema>
+  </types>
+  <message name="m"><part name="p" type="tns:U"/></message>
+  <portType name="pt"><operation name="test"><input message="tns:m"/></operation></portType>
+  <binding name="b" type="tns:pt">
+    <soap:binding style="rpc" transport="http://schemas.xmlsoap.org/soap/http"/>
+    <operation name="test"><soap:operation soapAction="#test"/>
+      <input><soap:body use="encoded" namespace="urn:t" encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"/></input>
+    </operation>
+  </binding>
+  <service name="s"><port name="p" binding="tns:b"><soap:address location="test://"/></port></service>
+</definitions>
+XML;
+$c = new SoapClient("data://text/plain;base64," . base64_encode($wsdl), ["cache_wsdl" => WSDL_CACHE_NONE]);
+try {
+    $c->test([[1]]);
+} catch (SoapFault $e) {
+    echo $e->getMessage(), "\n";
+}
+?>
+--EXPECT--
+SOAP-ERROR: Encoding: Failed to encode list item of type 'unknown' for list type 'U'

From 96183bed30aa0a5ba766c58a1e8a3334aa19ab0b Mon Sep 17 00:00:00 2001
From: lazerg <lazerg2@gmail.com>
Date: Mon, 9 Nov 2026 10:23:02 +0500
Subject: [PATCH 2/2] Fix GH-25303: Use a dedicated union error message in
 to_xml_list()

---
 ext/soap/php_encoding.c     | 19 +++++++++++++------
 ext/soap/tests/gh25303.phpt |  2 +-
 2 files changed, 14 insertions(+), 7 deletions(-)

diff --git a/ext/soap/php_encoding.c b/ext/soap/php_encoding.c
index 9afd93b7625c..05e12de5f021 100644
--- a/ext/soap/php_encoding.c
+++ b/ext/soap/php_encoding.c
@@ -3080,6 +3080,17 @@ static zval* to_zval_list(zval *ret, encodeTypePtr enc, xmlNodePtr data) {
 	return to_zval_stringc(ret, enc, data);
 }
 
+static void to_xml_list_item_error(encodeTypePtr enc, encodePtr list_enc)
+{
+	if (enc->sdl_type && enc->sdl_type->kind == XSD_TYPEKIND_UNION) {
+		soap_error1(E_ERROR, "Encoding: Value does not match any member type of union type '%s'",
+			soap_type_name(enc));
+	} else {
+		soap_error2(E_ERROR, "Encoding: Failed to encode list item of type '%s' for list type '%s'",
+			soap_type_name(list_enc ? &list_enc->details : NULL), soap_type_name(enc));
+	}
+}
+
 static xmlNodePtr to_xml_list(encodeTypePtr enc, zval *data, int style, xmlNodePtr parent) {
 	xmlNodePtr ret;
 	encodePtr list_enc = NULL;
@@ -3115,9 +3126,7 @@ static xmlNodePtr to_xml_list(encodeTypePtr enc, zval *data, int style, xmlNodeP
 				}
 				smart_str_appends(&list, (char*)dummy->children->content);
 			} else {
-				soap_error2(E_ERROR,
-					"Encoding: Failed to encode list item of type '%s' for list type '%s'",
-					soap_type_name(list_enc ? &list_enc->details : NULL), soap_type_name(enc));
+				to_xml_list_item_error(enc, list_enc);
 			}
 			xmlUnlinkNode(dummy);
 			xmlFreeNode(dummy);
@@ -3159,9 +3168,7 @@ static xmlNodePtr to_xml_list(encodeTypePtr enc, zval *data, int style, xmlNodeP
 				}
 				smart_str_appends(&list, (char*)dummy->children->content);
 			} else {
-				soap_error2(E_ERROR,
-					"Encoding: Failed to encode list item of type '%s' for list type '%s'",
-					soap_type_name(list_enc ? &list_enc->details : NULL), soap_type_name(enc));
+				to_xml_list_item_error(enc, list_enc);
 			}
 			xmlUnlinkNode(dummy);
 			xmlFreeNode(dummy);
diff --git a/ext/soap/tests/gh25303.phpt b/ext/soap/tests/gh25303.phpt
index 3a38b9f57b24..d58c36d4efdc 100644
--- a/ext/soap/tests/gh25303.phpt
+++ b/ext/soap/tests/gh25303.phpt
@@ -33,4 +33,4 @@ try {
 }
 ?>
 --EXPECT--
-SOAP-ERROR: Encoding: Failed to encode list item of type 'unknown' for list type 'U'
+SOAP-ERROR: Encoding: Value does not match any member type of union type 'U'