Commit 18ece89354c for php

commit 18ece89354c60f86f3dae644745739bb0cede9e6
Author: lazerg <lazerg2@gmail.com>
Date:   Mon Nov 9 13:23:37 2026 +0000

    Fix GH-25303: NULL encoder dereference in to_xml_list() error message

    A union type (and a list without an item type) leaves list_enc NULL in
    to_xml_list(). When an item fails to encode, the error message reads
    list_enc->details and dereferences NULL. Union types now get a dedicated
    error message, and a NULL list_enc prints "unknown".

    Close GH-25316

diff --git a/NEWS b/NEWS
index 444a3c9d1ad..95c3ae0d484 100644
--- a/NEWS
+++ b/NEWS
@@ -62,6 +62,8 @@ PHP                                                                        NEWS
 - SOAP:
   . Fixed bug GH-25267 (NULL dereference in to_xml_any() with integer key).
     (lazerg)
+  . Fixed bug GH-25303 (NULL encoder dereference in to_xml_list() error
+    message). (lazerg)

 - Readline:
   . Fixed incorrect handling of non-ASCII pending_input bytes in readline_info(),
diff --git a/ext/soap/php_encoding.c b/ext/soap/php_encoding.c
index 8d869b6705d..05e12de5f02 100644
--- a/ext/soap/php_encoding.c
+++ b/ext/soap/php_encoding.c
@@ -3080,6 +3080,17 @@ static zval* to_zval_list(zval *ret, encodeTypePtr enc, xmlNodePtr data) {
 	return to_zval_stringc(ret, enc, data);
 }

+static void to_xml_list_item_error(encodeTypePtr enc, encodePtr list_enc)
+{
+	if (enc->sdl_type && enc->sdl_type->kind == XSD_TYPEKIND_UNION) {
+		soap_error1(E_ERROR, "Encoding: Value does not match any member type of union type '%s'",
+			soap_type_name(enc));
+	} else {
+		soap_error2(E_ERROR, "Encoding: Failed to encode list item of type '%s' for list type '%s'",
+			soap_type_name(list_enc ? &list_enc->details : NULL), soap_type_name(enc));
+	}
+}
+
 static xmlNodePtr to_xml_list(encodeTypePtr enc, zval *data, int style, xmlNodePtr parent) {
 	xmlNodePtr ret;
 	encodePtr list_enc = NULL;
@@ -3115,9 +3126,7 @@ static xmlNodePtr to_xml_list(encodeTypePtr enc, zval *data, int style, xmlNodeP
 				}
 				smart_str_appends(&list, (char*)dummy->children->content);
 			} else {
-				soap_error2(E_ERROR,
-					"Encoding: Failed to encode list item of type '%s' for list type '%s'",
-					soap_type_name(&list_enc->details), soap_type_name(enc));
+				to_xml_list_item_error(enc, list_enc);
 			}
 			xmlUnlinkNode(dummy);
 			xmlFreeNode(dummy);
@@ -3159,9 +3168,7 @@ static xmlNodePtr to_xml_list(encodeTypePtr enc, zval *data, int style, xmlNodeP
 				}
 				smart_str_appends(&list, (char*)dummy->children->content);
 			} else {
-				soap_error2(E_ERROR,
-					"Encoding: Failed to encode list item of type '%s' for list type '%s'",
-					soap_type_name(&list_enc->details), soap_type_name(enc));
+				to_xml_list_item_error(enc, list_enc);
 			}
 			xmlUnlinkNode(dummy);
 			xmlFreeNode(dummy);
diff --git a/ext/soap/tests/gh25303.phpt b/ext/soap/tests/gh25303.phpt
new file mode 100644
index 00000000000..d58c36d4efd
--- /dev/null
+++ b/ext/soap/tests/gh25303.phpt
@@ -0,0 +1,36 @@
+--TEST--
+GH-25303 (NULL encode dereference in to_xml_list() error path for union types)
+--EXTENSIONS--
+soap
+--CREDITS--
+YuanchengJiang
+--FILE--
+<?php
+$wsdl = <<<XML
+<definitions xmlns="http://schemas.xmlsoap.org/wsdl/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/"
+    xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:tns="urn:t" targetNamespace="urn:t">
+  <types>
+    <xsd:schema targetNamespace="urn:t">
+      <xsd:simpleType name="U"><xsd:union memberTypes="xsd:int"/></xsd:simpleType>
+    </xsd:schema>
+  </types>
+  <message name="m"><part name="p" type="tns:U"/></message>
+  <portType name="pt"><operation name="test"><input message="tns:m"/></operation></portType>
+  <binding name="b" type="tns:pt">
+    <soap:binding style="rpc" transport="http://schemas.xmlsoap.org/soap/http"/>
+    <operation name="test"><soap:operation soapAction="#test"/>
+      <input><soap:body use="encoded" namespace="urn:t" encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"/></input>
+    </operation>
+  </binding>
+  <service name="s"><port name="p" binding="tns:b"><soap:address location="test://"/></port></service>
+</definitions>
+XML;
+$c = new SoapClient("data://text/plain;base64," . base64_encode($wsdl), ["cache_wsdl" => WSDL_CACHE_NONE]);
+try {
+    $c->test([[1]]);
+} catch (SoapFault $e) {
+    echo $e->getMessage(), "\n";
+}
+?>
+--EXPECT--
+SOAP-ERROR: Encoding: Value does not match any member type of union type 'U'