Commit 673896f8e91 for php.net

commit 673896f8e91bc82ce11a43be071dd0ab3271bb30
Merge: b117d8edf1f df4a960ff89
Author: Ilia Alshanetsky <ilia@ilia.ws>
Date:   Mon Sep 7 18:13:06 2026 -0400

    Merge branch 'PHP-8.5'

    * PHP-8.5:
      soap: reject self-referential schema group and attributeGroup fix-up

diff --cc NEWS
index c1bf79e07fb,236c96b42b4..cae4c0bbcc6
--- a/NEWS
+++ b/NEWS
@@@ -78,11 -93,9 +78,13 @@@ PH
  - SOAP:
    . Fixed WSDL cache corruption when a soap:header defines headerfaults.
      (Ilia Alshanetsky)
+   . Fixed stack overflow when parsing a WSDL with self-referential schema
+     groups or attributeGroups. (Ilia Alshanetsky)

 +- Sodium:
 +  . Added support for the libsodium 1.0.22 KEM APIs (X-Wing and ML-KEM768).
 +    (Zachary DuBois)
 +
  - Standard:
    . Fixed a segfault when a stream filter callback unsets StreamBucket::$data
      before re-attaching the bucket. (iliaal)
diff --cc ext/soap/php_schema.c
index b675b97b469,b2636f12149..195c5abe45e
--- a/ext/soap/php_schema.c
+++ b/ext/soap/php_schema.c
@@@ -2193,6 -2173,10 +2193,10 @@@ static void schema_attributegroup_fixup
  		if (ctx->attributeGroups != NULL) {
  			tmp = (sdlTypePtr)schema_find_by_ref(ctx->attributeGroups, attr->ref);
  			if (tmp) {
 -				if (zend_hash_index_find_ptr(&ctx->fixupInProgress, (zend_ulong)tmp) != NULL) {
++				if (zend_hash_index_find_ptr(&ctx->fixupInProgress, (zend_ulong)(uintptr_t)tmp) != NULL) {
+ 					soap_error1(E_ERROR, "Parsing Schema: recursive attributeGroup 'ref' attribute '%s'", attr->ref);
+ 				}
 -				zend_hash_index_add_ptr(&ctx->fixupInProgress, (zend_ulong)tmp, tmp);
++				zend_hash_index_add_ptr(&ctx->fixupInProgress, (zend_ulong)(uintptr_t)tmp, tmp);
  				if (tmp->attributes) {
  					zend_hash_internal_pointer_reset(tmp->attributes);
  					while ((tmp_attr = zend_hash_get_current_data_ptr(tmp->attributes)) != NULL) {
@@@ -2228,6 -2212,7 +2232,7 @@@
  						}
  					}
  				}
 -				zend_hash_index_del(&ctx->fixupInProgress, (zend_ulong)tmp);
++				zend_hash_index_del(&ctx->fixupInProgress, (zend_ulong)(uintptr_t)tmp);
  			}
  		}
  		efree(attr->ref);
@@@ -2242,6 -2227,9 +2247,9 @@@ static void schema_content_model_fixup(
  			sdlTypePtr tmp;

  			if (ctx->sdl->groups && (tmp = zend_hash_str_find_ptr(ctx->sdl->groups, model->u.group_ref, strlen(model->u.group_ref))) != NULL) {
 -				if (zend_hash_index_find_ptr(&ctx->fixupInProgress, (zend_ulong)tmp) != NULL) {
++				if (zend_hash_index_find_ptr(&ctx->fixupInProgress, (zend_ulong)(uintptr_t)tmp) != NULL) {
+ 					soap_error1(E_ERROR, "Parsing Schema: recursive group 'ref' attribute '%s'", model->u.group_ref);
+ 				}
  				schema_type_fixup(ctx, tmp);
  				efree(model->u.group_ref);
  				model->kind = XSD_CONTENT_GROUP;
@@@ -2285,6 -2273,8 +2293,8 @@@ static void schema_type_fixup(sdlCtx *c
  	sdlTypePtr tmp;
  	sdlAttributePtr attr;

 -	zend_hash_index_add_ptr(&ctx->fixupInProgress, (zend_ulong)type, type);
++	zend_hash_index_add_ptr(&ctx->fixupInProgress, (zend_ulong)(uintptr_t)type, type);
+
  	if (type->ref != NULL) {
  		if (ctx->sdl->elements != NULL) {
  			tmp = (sdlTypePtr)schema_find_by_ref(ctx->sdl->elements, type->ref);
@@@ -2337,6 -2327,7 +2347,7 @@@
  			}
  		}
  	}
 -	zend_hash_index_del(&ctx->fixupInProgress, (zend_ulong)type);
++	zend_hash_index_del(&ctx->fixupInProgress, (zend_ulong)(uintptr_t)type);
  }

  void schema_pass2(sdlCtx *ctx)