[php-src] PHP-8.4: ext/filter: encode 0xFF in FILTER_SANITIZE_ENCODED

Author: Ilia Alshanetsky (iliaal)
Date: 2026-07-20T19:28:50-04:00

Commit: https://github.com/php/php-src/commit/56149186d81469fd7fb2f8444359ee81dd4a70f4
Raw diff: https://github.com/php/php-src/commit/56149186d81469fd7fb2f8444359ee81dd4a70f4.diff

ext/filter: encode 0xFF in FILTER_SANITIZE_ENCODED

php_filter_encode_url() initialized its 256-byte "must encode" table with
memset(tmp, 1, sizeof(tmp) - 1), leaving tmp[255] uninitialized. Whether
0xFF got percent-encoded then depended on stack garbage; valgrind reports
the read as a conditional jump on an uninitialised value. Initialize the
whole table.

Closes GH-22762

Changed paths:
  A  ext/filter/tests/filter_sanitize_encoded_0xff.phpt
  M  ext/filter/sanitizing_filters.c


Diff:

diff --git a/ext/filter/sanitizing_filters.c b/ext/filter/sanitizing_filters.c
index 647d559c1df5..a356722765be 100644
--- a/ext/filter/sanitizing_filters.c
+++ b/ext/filter/sanitizing_filters.c
@@ -68,7 +68,7 @@ static void php_filter_encode_url(zval *value, const unsigned char* chars, const
 	unsigned char *e = s + char_len;
 	zend_string *str;
 
-	memset(tmp, 1, sizeof(tmp)-1);
+	memset(tmp, 1, sizeof(tmp));
 
 	while (s < e) {
 		tmp[*s++] = '\0';
diff --git a/ext/filter/tests/filter_sanitize_encoded_0xff.phpt b/ext/filter/tests/filter_sanitize_encoded_0xff.phpt
new file mode 100644
index 000000000000..1ee61aba7b70
--- /dev/null
+++ b/ext/filter/tests/filter_sanitize_encoded_0xff.phpt
@@ -0,0 +1,12 @@
+--TEST--
+FILTER_SANITIZE_ENCODED percent-encodes 0xFF
+--EXTENSIONS--
+filter
+--FILE--
+<?php
+var_dump(filter_var("\xFF", FILTER_SANITIZE_ENCODED));
+var_dump(filter_var("\xFE\xFF\x00A", FILTER_SANITIZE_ENCODED));
+?>
+--EXPECT--
+string(3) "%FF"
+string(10) "%FE%FF%00A"