From cf2f699a6de663554c000bc0cdf26e3a18f5ae9f Mon Sep 17 00:00:00 2001 From: David Carlier Date: Sat, 4 Jul 2026 14:20:54 +0100 Subject: [PATCH 1/2] ext/soap: backport GH-22586 fix. close GH-22592 --- ext/soap/soap.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ext/soap/soap.c b/ext/soap/soap.c index ce12aeaf364c..3d5536ef8628 100644 --- a/ext/soap/soap.c +++ b/ext/soap/soap.c @@ -2235,6 +2235,10 @@ static bool do_request(zval *this_ptr, xmlDoc *request, const char *location, co return false; } + ZVAL_UNDEF(¶ms[0]); + ZVAL_UNDEF(¶ms[1]); + ZVAL_UNDEF(¶ms[2]); + zend_try { zval *trace = Z_CLIENT_TRACE_P(this_ptr); if (Z_TYPE_P(trace) == IS_TRUE) { From 21bf7f67ff0e53eee15d79d5a8862e2f1c4a37c4 Mon Sep 17 00:00:00 2001 From: Jorg Adam Sowa Date: Sat, 4 Jul 2026 20:07:49 +0200 Subject: [PATCH 2/2] phpdbg: Fix off-by-one in phpdbg_safe_class_lookup() signal-safe class lookup (#22593) lc_length was set to name_length + 1, one past the actual lowercased string length, so zend_hash_str_find_ptr() (which expects a strlen-style length) never matched an existing class entry. This made class lookups during phpdbg's signal-handler interruption path always fail silently. Replaced the manual emalloc/tolower/efree dance with zend_hash_str_find_ptr_lc(), which performs the lowercase copy and lookup in one call and removes the surface for this class of bug. --- NEWS | 2 ++ sapi/phpdbg/phpdbg_utils.c | 17 ++++------------- 2 files changed, 6 insertions(+), 13 deletions(-) diff --git a/NEWS b/NEWS index 08a852a5a0d8..d950ce969fc1 100644 --- a/NEWS +++ b/NEWS @@ -44,6 +44,8 @@ PHP NEWS . Fixed bug GH-17387 (Trivial crash in phpdbg lexer). (iliaal) . Fixed fleaked lowercased lookup keys in phpdbg_resolve_opline_break. (jorgsowa) + . Fixed off-by-one in phpdbg_safe_class_lookup() causing class lookups to + always fail during phpdbg's signal-safe interruption path. (jorgsowa) - Reflection: . Fixed bug GH-22324 (Ignore leading namespace separator in diff --git a/sapi/phpdbg/phpdbg_utils.c b/sapi/phpdbg/phpdbg_utils.c index 7465004e99ad..b3d3445b6272 100644 --- a/sapi/phpdbg/phpdbg_utils.c +++ b/sapi/phpdbg/phpdbg_utils.c @@ -397,29 +397,20 @@ PHPDBG_API void phpdbg_set_async_io(int fd) { int phpdbg_safe_class_lookup(const char *name, int name_length, zend_class_entry **ce) { if (PHPDBG_G(flags) & PHPDBG_IN_SIGNAL_HANDLER) { - char *lc_name, *lc_free; - int lc_length; - if (name == NULL || !name_length) { return FAILURE; } - lc_free = lc_name = emalloc(name_length + 1); - zend_str_tolower_copy(lc_name, name, name_length); - lc_length = name_length + 1; - - if (lc_name[0] == '\\') { - lc_name += 1; - lc_length -= 1; + if (name[0] == '\\') { + name += 1; + name_length -= 1; } phpdbg_try_access { - *ce = zend_hash_str_find_ptr(EG(class_table), lc_name, lc_length); + *ce = zend_hash_str_find_ptr_lc(EG(class_table), name, name_length); } phpdbg_catch_access { phpdbg_error("Could not fetch class %.*s, invalid data source", name_length, name); } phpdbg_end_try_access(); - - efree(lc_free); } else { zend_string *str_name = zend_string_init(name, name_length, 0); *ce = zend_lookup_class(str_name);