From aee3b3ac9b816b0def1c462695b483b49a83148e Mon Sep 17 00:00:00 2001 From: Ilija Tovilo Date: Sun, 3 May 2026 19:56:53 +0200 Subject: [PATCH] GHSA-85c2-q967-79q5: [soap] Fix stale SOAP_GLOBAL(ref_map) pointer with Apache Map Fixes GHSA-85c2-q967-79q5 Fixes CVE-2026-6722 --- ext/soap/php_encoding.c | 3 +- ext/soap/tests/GHSA-85c2-q967-79q5.phpt | 61 +++++++++++++++++++++++++ 2 files changed, 63 insertions(+), 1 deletion(-) create mode 100644 ext/soap/tests/GHSA-85c2-q967-79q5.phpt Index: php-7.4.33/ext/soap/php_encoding.c =================================================================== --- php-7.4.33.orig/ext/soap/php_encoding.c +++ php-7.4.33/ext/soap/php_encoding.c @@ -367,6 +367,7 @@ static zend_bool soap_check_xml_ref(zval static void soap_add_xml_ref(zval *data, xmlNodePtr node) { if (SOAP_GLOBAL(ref_map)) { + Z_TRY_ADDREF_P(data); zend_hash_index_update(SOAP_GLOBAL(ref_map), (zend_ulong)node, data); } } @@ -3428,7 +3429,7 @@ void encode_reset_ns() } else { SOAP_GLOBAL(ref_map) = emalloc(sizeof(HashTable)); } - zend_hash_init(SOAP_GLOBAL(ref_map), 0, NULL, NULL, 0); + zend_hash_init(SOAP_GLOBAL(ref_map), 0, NULL, ZVAL_PTR_DTOR, 0); } void encode_finish()