Commit 1ba316a2f16 for php

commit 1ba316a2f16703169c0fa41fda6545c6b0c385d5
Author: lazerg <lazerg2@gmail.com>
Date:   Sat Nov 7 12:01:25 2026 -0500

    Fix GH-25267: NULL dereference in to_xml_any() with integer key

    to_xml_any() renamed each output node after its array key, but an integer
    key has no zend_string, so ZSTR_VAL() dereferenced NULL. Rename only for
    string keys, as to_xml_object() does, so an integer-keyed element keeps its
    default name.

    Fixes GH-25267
    Closes GH-25270

diff --git a/NEWS b/NEWS
index 2d3e9d00d30..668b5898c62 100644
--- a/NEWS
+++ b/NEWS
@@ -25,6 +25,10 @@ PHP                                                                        NEWS
   . Fixed bug GH-16396 (Failed to invoke user error handler during index
     conversion in JIT). (Jorg Sowa)

+- SOAP:
+  . Fixed bug GH-25267 (NULL dereference in to_xml_any() with integer key).
+    (lazerg)
+
 - Streams:
   . Fixed bug GH-22063 (Stream filter chain UAF on self-removal during
     callback). (Ilia Alshanetsky)
diff --git a/ext/soap/php_encoding.c b/ext/soap/php_encoding.c
index 8fc429ffe25..56317abf4ab 100644
--- a/ext/soap/php_encoding.c
+++ b/ext/soap/php_encoding.c
@@ -3237,7 +3237,7 @@ static xmlNodePtr to_xml_any(encodeTypePtr type, zval *data, int style, xmlNodeP

 		ZEND_HASH_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(data), name, el) {
 			ret = master_to_xml(enc, el, style, parent);
-		    if (ret &&
+		    if (ret && name &&
 		        ret->name != xmlStringTextNoenc) {
 				xmlNodeSetName(ret, BAD_CAST(ZSTR_VAL(name)));
 		    }
diff --git a/ext/soap/tests/gh25267.phpt b/ext/soap/tests/gh25267.phpt
new file mode 100644
index 00000000000..c67411828d1
--- /dev/null
+++ b/ext/soap/tests/gh25267.phpt
@@ -0,0 +1,20 @@
+--TEST--
+GH-25267 (NULL zend_string dereference in to_xml_any with integer key)
+--EXTENSIONS--
+soap
+--CREDITS--
+YuanchengJiang
+--FILE--
+<?php
+class C extends SoapClient {
+    function __doRequest($request, $location, $action, $version, $one_way = false, ?string $uriParserClass = null): string {
+        echo $request;
+        return "";
+    }
+}
+$c = new C(null, ["location" => "test://", "uri" => "test://"]);
+$c->foo(new SoapVar([new SoapVar("y", XSD_STRING), "a" => new SoapVar("x", XSD_STRING)], XSD_ANYXML));
+?>
+--EXPECT--
+<?xml version="1.0" encoding="UTF-8"?>
+<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="test://" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><ns1:foo><BOGUS xsi:type="xsd:string">y</BOGUS><a xsi:type="xsd:string">x</a></ns1:foo></SOAP-ENV:Body></SOAP-ENV:Envelope>