Commit 988eb99c2c2 for php.net

commit 988eb99c2c21d4ca682b86a3bcf25e883b065475
Author: Weilin Du <weilindu@php.net>
Date:   Sun Jul 19 05:24:42 2026 +0800

    ext/gmp: Fix GMP accepting integer strings with NUL bytes (#22798)

    convert_zstr_to_gmp() passes PHP strings to mpz_set_str(), which treats
    input as a NUL-terminated C string. This allowed strings like
    "123\0abc" to be accepted as 123.

    Reject strings containing NUL bytes with zend_str_has_nul_byte()
    before calling into GMP, preserving the existing "not an integer
    string" error path.

diff --git a/ext/gmp/gmp.c b/ext/gmp/gmp.c
index b05706e4829..a5cbdba3484 100644
--- a/ext/gmp/gmp.c
+++ b/ext/gmp/gmp.c
@@ -644,6 +644,15 @@ static zend_result convert_zstr_to_gmp(mpz_t gmp_number, const zend_string *val,
 	const char *num_str = ZSTR_VAL(val);
 	bool skip_lead = false;

+	if (UNEXPECTED(zend_str_has_nul_byte(val))) {
+		if (arg_pos == 0) {
+			zend_value_error("Number is not an integer string");
+		} else {
+			zend_argument_value_error(arg_pos, "is not an integer string");
+		}
+		return FAILURE;
+	}
+
 	size_t num_len = ZSTR_LEN(val);
 	while (isspace((unsigned char)*num_str)) {
 		++num_str;
diff --git a/ext/gmp/tests/gmp_null_bytes.phpt b/ext/gmp/tests/gmp_null_bytes.phpt
new file mode 100644
index 00000000000..1518d342dda
--- /dev/null
+++ b/ext/gmp/tests/gmp_null_bytes.phpt
@@ -0,0 +1,28 @@
+--TEST--
+GMP rejects integer strings containing null bytes
+--EXTENSIONS--
+gmp
+--FILE--
+<?php
+
+$tests = [
+    'gmp_init' => fn() => gmp_init("123\0abc"),
+    'gmp_init prefix' => fn() => gmp_init("0x10\0ff"),
+    'gmp_add' => fn() => gmp_add("123\0abc", 1),
+    'constructor' => fn() => new GMP("123\0abc"),
+];
+
+foreach ($tests as $label => $test) {
+    try {
+        $test();
+    } catch (ValueError $e) {
+        echo $label, ": ", $e->getMessage(), PHP_EOL;
+    }
+}
+
+?>
+--EXPECT--
+gmp_init: gmp_init(): Argument #1 ($num) is not an integer string
+gmp_init prefix: gmp_init(): Argument #1 ($num) is not an integer string
+gmp_add: gmp_add(): Argument #1 ($num1) is not an integer string
+constructor: GMP::__construct(): Argument #1 ($num) is not an integer string