File php7-CVE-2025-14181.patch of Package php7

From e01f6fad9f4d10d3cda37a07f6e5d1619944dafc Mon Sep 17 00:00:00 2001
From: Nora Dossche <7771979+ndossche@users.noreply.github.com>
Date: Sun, 13 Sep 2026 18:30:55 +0200
Subject: [PATCH] Fix GHSA-cj93-vc83-wgqv

Co-authored-by: Jakub Zelenka <bukka@php.net>
---
 ext/soap/php_http.c                          |  19 ++-
 ext/soap/tests/bugs/GHSA-cj93-vc83-wgqv.phpt | 155 +++++++++++++++++++
 2 files changed, 167 insertions(+), 7 deletions(-)
 create mode 100644 ext/soap/tests/bugs/GHSA-cj93-vc83-wgqv.phpt

Index: php-7.4.33/ext/soap/php_http.c
===================================================================
--- php-7.4.33.orig/ext/soap/php_http.c
+++ php-7.4.33/ext/soap/php_http.c
@@ -1135,7 +1135,7 @@ try_again:
 							char *t = ZSTR_VAL(phpurl->path);
 							char *p = strrchr(t, '/');
 							if (p) {
-								zend_string *s = zend_string_alloc((p - t) + ZSTR_LEN(new_url->path) + 2, 0);
+								zend_string *s = zend_string_safe_alloc(1, p - t, ZSTR_LEN(new_url->path) + 2, 0);
 								strncpy(ZSTR_VAL(s), t, (p - t) + 1);
 								ZSTR_VAL(s)[(p - t) + 1] = 0;
 								strcat(ZSTR_VAL(s), ZSTR_VAL(new_url->path));
@@ -1428,7 +1428,8 @@ static zend_string* get_http_body(php_st
 {
 	zend_string *http_buf = NULL;
 	char *header;
-	int header_close = close, header_chunked = 0, header_length = 0, http_buf_size = 0;
+	int header_close = close, header_chunked = 0, header_length = 0;
+	size_t http_buf_size = 0;
 
 	if (!close) {
 		header = get_http_header_value(headers, "Connection: ");
@@ -1458,14 +1459,14 @@ static zend_string* get_http_body(php_st
 		done = FALSE;
 
 		while (!done) {
-			int buf_size = 0;
+			unsigned int buf_size = 0;
 
 			php_stream_gets(stream, headerbuf, sizeof(headerbuf));
 			if (sscanf(headerbuf, "%x", &buf_size) > 0 ) {
 				if (buf_size > 0) {
 					size_t len_size = 0;
 
-					if (http_buf_size + buf_size + 1 < 0) {
+					if (buf_size >= ZSTR_MAX_LEN - http_buf_size) {
 						if (http_buf) {
 							zend_string_release_ex(http_buf, 0);
 						}
@@ -1473,7 +1474,7 @@ static zend_string* get_http_body(php_st
 					}
 
 					if (http_buf) {
-						http_buf = zend_string_realloc(http_buf, http_buf_size + buf_size, 0);
+						http_buf = zend_string_safe_realloc(http_buf, 1, http_buf_size, buf_size, 0);
 					} else {
 						http_buf = zend_string_alloc(buf_size, 0);
 					}
@@ -1532,7 +1533,7 @@ static zend_string* get_http_body(php_st
 		}
 
 	} else if (header_length) {
-		if (header_length < 0 || header_length >= INT_MAX) {
+		if (header_length < 0 || header_length >= ZSTR_MAX_LEN) {
 			return NULL;
 		}
 		http_buf = zend_string_alloc(header_length, 0);
@@ -1547,7 +1548,11 @@ static zend_string* get_http_body(php_st
 		do {
 			ssize_t len_read;
 			if (http_buf) {
-				http_buf = zend_string_realloc(http_buf, http_buf_size + 4096, 0);
+				if (UNEXPECTED(http_buf_size >= ZSTR_MAX_LEN - 4096)) {
+					zend_string_efree(http_buf);
+					return NULL;
+				}
+				http_buf = zend_string_realloc(http_buf, http_buf_size + 4096, 0);
 			} else {
 				http_buf = zend_string_alloc(4096, 0);
 			}