[GIT-PULLS] [php-src] PR #22888: Fix OOB access on a SOAP array with a dimensionless arraySize
[email protected] (devnexen) Sat, 25 Jul 2026 16:46:26 +0000
| Newsgroups | php.git-pulls |
|---|---|
| Message-ID | <9qcuiD6pvz0OPRwMLiUFIi6uBlz9E2Pwf3lFmyyibgQ@main.internal.php.net> |
Pull Request: https://github.com/php/php-src/pull/22888 Author: devnexen calc_dimension_12() returned 0 for an arraySize holding neither a digit nor a '*', so to_zval_array() read pos[0] and to_xml_array() read and wrote dims[0] on a zero-element allocation. Treat such a value as one dimension of unspecified size, like a missing attribute. Fixes GH-22887