Commit 85cb6e421a0 for php.net

commit 85cb6e421a0bdb68e47b174255f98e1d192b8785
Author: Niels Dossche <7771979+ndossche@users.noreply.github.com>
Date:   Sat Dec 13 15:08:45 2025 +0100

    Fix GH-20695: Assertion failure in normalize_value() when parsing malformed INI input via parse_ini_string()

    I think there's simply a reasoning error about when which scanner state
    can cause which parser component to invoke later on.

    Closes GH-20702.

diff --git a/NEWS b/NEWS
index 5103b4a9679..5cbee8cb2c5 100644
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,8 @@ PHP                                                                        NEWS
 - Core:
   . Fix OSS-Fuzz #465488618 (Wrong assumptions when dumping function signature
     with dynamic class const lookup default argument). (ilutov)
+  . Fixed bug GH-20695 (Assertion failure in normalize_value() when parsing
+    malformed INI input via parse_ini_string()). (ndossche)

 - Bz2:
   . Fixed bug GH-20620 (bzcompress overflow on large source size).
diff --git a/Zend/zend_ini_scanner.l b/Zend/zend_ini_scanner.l
index b87f4e33cc8..b4013e8334f 100644
--- a/Zend/zend_ini_scanner.l
+++ b/Zend/zend_ini_scanner.l
@@ -145,10 +145,10 @@ ZEND_API zend_ini_scanner_globals ini_scanner_globals;
 	if (SCNG(scanner_mode) == ZEND_INI_SCANNER_TYPED &&            \
 		(YYSTATE == STATE(ST_VALUE) || YYSTATE == STATE(ST_RAW))) {\
 		zend_ini_copy_typed_value(ini_lval, type, str, len);       \
-		Z_EXTRA_P(ini_lval) = 0;                                   \
 	} else {                                                       \
 		zend_ini_copy_value(ini_lval, str, len);                   \
 	}                                                              \
+	Z_EXTRA_P(ini_lval) = 0;                                       \
 	return type;                                                   \
 }

diff --git a/ext/standard/tests/gh20695.phpt b/ext/standard/tests/gh20695.phpt
new file mode 100644
index 00000000000..64c81ab9fdb
--- /dev/null
+++ b/ext/standard/tests/gh20695.phpt
@@ -0,0 +1,14 @@
+--TEST--
+GH-20695 (Assertion failure in normalize_value() when parsing malformed INI input via parse_ini_string())
+--FILE--
+<?php
+var_dump(parse_ini_string('8 [[] = !!$]', true, INI_SCANNER_TYPED));
+?>
+--EXPECT--
+array(1) {
+  [8]=>
+  array(1) {
+    ["["]=>
+    int(0)
+  }
+}