Commit 4c955f4a2b2 for php.net

commit 4c955f4a2b2cbd2c711451536d2e00d9947435f0
Merge: 7c3c8d677bc 9e696413e89
Author: Ilia Alshanetsky <ilia@ilia.ws>
Date:   Sun Aug 9 14:05:42 2026 -0400

    Merge branch 'PHP-8.4' into PHP-8.5

    * PHP-8.4:
      Fix SimpleXML integer offsets that cannot resolve aliasing a node

diff --cc NEWS
index 7fcd21fbbdc,05e3a23118d..e99924f024e
--- a/NEWS
+++ b/NEWS
@@@ -62,9 -55,11 +62,13 @@@ PH
    . Fixed bug GH-23043 (broken session id code can cause zend_mm_heap
      corrupted). (ndossche)

+ - SimpleXML:
+   . Fixed integer element offsets that cannot resolve aliasing an existing
+     element. (iliaal)
+
  - Sockets:
 +  . Fixed socket_set_option() validation error messages for UDP_SEGMENT and
 +    SO_LINGER options. (Weilin Du)
    . Fixed various memory related issues in ext/sockets. (David Carlier)

  - SQLite:
diff --cc ext/simplexml/simplexml.c
index 875be2b6e23,f3c1a073fca..e537bc3fb20
--- a/ext/simplexml/simplexml.c
+++ b/ext/simplexml/simplexml.c
@@@ -578,12 -589,16 +581,16 @@@ next_iter
  					newnode = xmlNewTextChild(mynode, NULL, (xmlChar *)Z_STRVAL_P(member), value_str ? (xmlChar *)ZSTR_VAL(value_str) : NULL);
  				}
  			} else if (!member || Z_TYPE_P(member) == IS_LONG) {
- 				if (member && cnt < Z_LVAL_P(member)) {
+ 				if (member && (Z_LVAL_P(member) < 0 || cnt < Z_LVAL_P(member))) {
  					php_error_docref(NULL, E_WARNING, "Cannot add element %s number " ZEND_LONG_FMT " when only " ZEND_LONG_FMT " such elements exist", mynode->name, Z_LVAL_P(member), cnt);
  				}
- 				newnode = xmlNewTextChild(mynode->parent, mynode->ns, mynode->name, value_str ? (xmlChar *)ZSTR_VAL(value_str) : NULL);
+ 				if (member && Z_LVAL_P(member) < 0) {
+ 					value = &EG(error_zval);
+ 				} else {
+ 					newnode = xmlNewTextChild(mynode->parent, mynode->ns, mynode->name, value_str ? (xmlChar *)ZSTR_VAL(value_str) : NULL);
+ 				}
  			}
 -		} else if (attribs) {
 +		} else {
  			if (Z_TYPE_P(member) == IS_LONG) {
  				php_error_docref(NULL, E_WARNING, "Cannot change attribute number " ZEND_LONG_FMT " when only %d attributes exist", Z_LVAL_P(member), nodendx);
  			} else {