[GIT-PULLS] [php-src] PR #22761: ext/soap: fix NULL deref on malformed HTTP status line

[email protected] (iliaal) Thu, 16 Jul 2026 12:31:41 +0000
Newsgroups php.git-pulls
Message-ID <[email protected]>
Pull Request: https://github.com/php/php-src/pull/22761
Author: iliaal

`make_http_soap_request()` looks for the reason phrase with strstr(tmp, " ") even when the first strstr() found no space. A status line carrying a version but no status code, such as "HTTP/1.1", leaves tmp NULL, so strstr() dereferences it and the client segfaults. A broken or hostile SOAP endpoint can crash the client talking to it.

The test drives a SoapClient against a socket answering "HTTP/1.1\r\nContent-Type: text/xml\r\nContent-Length: 0\r\n\r\n" and asserts __doRequest() returns an empty string.

Present on 8.3 through master, targeting 8.4 as the lowest actively supported branch.