[php-src] master: Merge branch 'PHP-8.5'

Author: Ilia Alshanetsky (iliaal)
Date: 2026-07-16T22:01:58-04:00

Commit: https://github.com/php/php-src/commit/547ebc39c1022811efa4248fff423f990d81f255
Raw diff: https://github.com/php/php-src/commit/547ebc39c1022811efa4248fff423f990d81f255.diff

Merge branch 'PHP-8.5'

* PHP-8.5:
  ext/soap: fix NULL deref on malformed HTTP status line

Changed paths:
  A  ext/soap/tests/http_status_line_no_code.phpt
  M  ext/soap/php_http.c


Diff:

diff --git a/ext/soap/php_http.c b/ext/soap/php_http.c
index fe808404b526..43c2182ae47a 100644
--- a/ext/soap/php_http.c
+++ b/ext/soap/php_http.c
@@ -957,14 +957,14 @@ bool make_http_soap_request(
 				if (tmp != NULL) {
 					tmp++;
 					http_status = atoi(tmp);
-				}
-				tmp = strstr(tmp," ");
-				if (tmp != NULL) {
-					tmp++;
-					if (http_msg) {
-						efree(http_msg);
+					tmp = strstr(tmp," ");
+					if (tmp != NULL) {
+						tmp++;
+						if (http_msg) {
+							efree(http_msg);
+						}
+						http_msg = estrdup(tmp);
 					}
-					http_msg = estrdup(tmp);
 				}
 				efree(http_version);
 
diff --git a/ext/soap/tests/http_status_line_no_code.phpt b/ext/soap/tests/http_status_line_no_code.phpt
new file mode 100644
index 000000000000..de943571a492
--- /dev/null
+++ b/ext/soap/tests/http_status_line_no_code.phpt
@@ -0,0 +1,33 @@
+--TEST--
+SoapClient: malformed HTTP status line without status code must not crash
+--EXTENSIONS--
+soap
+--FILE--
+<?php
+$serverCode = <<<'CODE'
+$server = stream_socket_server("tcp://127.0.0.1:0", $errno, $errstr);
+phpt_notify_server_start($server);
+$conn = stream_socket_accept($server);
+while (($line = fgets($conn)) !== false) {
+	if ($line === "\r\n" || $line === "\n") {
+		break;
+	}
+}
+fwrite($conn, "HTTP/1.1\r\nContent-Type: text/xml\r\nContent-Length: 0\r\n\r\n");
+fclose($conn);
+CODE;
+
+$clientCode = <<<'CODE'
+$client = new SoapClient(null, [
+	'location' => 'http://{{ ADDR }}',
+	'uri' => 'http://testuri.org',
+	'connection_timeout' => 3,
+]);
+var_dump($client->__doRequest('<x/>', 'http://{{ ADDR }}', 'T', 1));
+CODE;
+
+include sprintf('%s/../../openssl/tests/ServerClientTestCase.inc', __DIR__);
+ServerClientTestCase::getInstance()->run($clientCode, $serverCode);
+?>
+--EXPECT--
+string(0) ""