[php-src] master: Merge branch 'PHP-8.4' into PHP-8.5

Author: David Carlier (devnexen) Date: 2026-10-06T22:11:55+01:00 Commit: https://github.com/php/php-src/commit/53c7882365d482d1fca0a6660eb900bee92f8540 Raw diff: https://github.com/php/php-src/commit/53c7882365d482d1fca0a6660eb900bee92f8540.diff Merge branch 'PHP-8.4' into PHP-8.5 * PHP-8.4: ext/soap: fix use of uninitialized func in do_request() on OOM bailout Changed paths: A ext/soap/tests/gh22585.phpt M ext/soap/soap.c Diff: diff --git a/ext/soap/soap.c b/ext/soap/soap.c index 19db18e900b0..7817245b53ba 100644 --- a/ext/soap/soap.c +++ b/ext/soap/soap.c @@ -2258,6 +2258,7 @@ static bool do_request(zval *this_ptr, xmlDoc *request, const char *location, co return false; } + ZVAL_UNDEF(&func); ZVAL_UNDEF(&params[0]); ZVAL_UNDEF(&params[1]); ZVAL_UNDEF(&params[2]); diff --git a/ext/soap/tests/gh22585.phpt b/ext/soap/tests/gh22585.phpt new file mode 100644 index 000000000000..9d007d012b44 --- /dev/null +++ b/ext/soap/tests/gh22585.phpt @@ -0,0 +1,39 @@ +--TEST-- +GH-22585 (Use of uninitialized params in do_request() on out-of-memory bailout) +--EXTENSIONS-- +soap +--INI-- +soap.wsdl_cache_enabled=0 +memory_limit=64M +--FILE-- +<?php +/* Deep recursion that keeps issuing SOAP calls until memory is exhausted while + * do_request() is only part-way through initializing its params array. The + * cleanup path must not touch the uninitialized slots. Depending on the + * environment the run ends either by the recursion limit (reaching "Done") or + * by the memory-exhaustion fatal; both are fine, a crash/UB abort is not. */ +try { + class MySoapClient extends SoapClient { + public function __doRequest($request, $location, $action, $version, $one_way = false, ?string $uriParserClass = null): string { + return ''; + } + } + + function main() { + for (;;) { + $soap = new MySoapClient( + null, + ['location' => "http://localhost/soap.php", 'uri' => "http://localhost/"] + ); + $soap->call(1.1); + main(); + } + } + + main(); +} catch (\Throwable $e) { +} +echo "Done" . PHP_EOL; +?> +--EXPECTREGEX-- +(?s)(Done|.*Allowed memory size of \d+ bytes exhausted.*)