Commit 56149186d81 for php.net

commit 56149186d81469fd7fb2f8444359ee81dd4a70f4
Author: Ilia Alshanetsky <ilia@ilia.ws>
Date:   Thu Jul 16 09:15:28 2026 -0400

    ext/filter: encode 0xFF in FILTER_SANITIZE_ENCODED

    php_filter_encode_url() initialized its 256-byte "must encode" table with
    memset(tmp, 1, sizeof(tmp) - 1), leaving tmp[255] uninitialized. Whether
    0xFF got percent-encoded then depended on stack garbage; valgrind reports
    the read as a conditional jump on an uninitialised value. Initialize the
    whole table.

    Closes GH-22762

diff --git a/ext/filter/sanitizing_filters.c b/ext/filter/sanitizing_filters.c
index 647d559c1df..a356722765b 100644
--- a/ext/filter/sanitizing_filters.c
+++ b/ext/filter/sanitizing_filters.c
@@ -68,7 +68,7 @@ static void php_filter_encode_url(zval *value, const unsigned char* chars, const
 	unsigned char *e = s + char_len;
 	zend_string *str;

-	memset(tmp, 1, sizeof(tmp)-1);
+	memset(tmp, 1, sizeof(tmp));

 	while (s < e) {
 		tmp[*s++] = '\0';
diff --git a/ext/filter/tests/filter_sanitize_encoded_0xff.phpt b/ext/filter/tests/filter_sanitize_encoded_0xff.phpt
new file mode 100644
index 00000000000..1ee61aba7b7
--- /dev/null
+++ b/ext/filter/tests/filter_sanitize_encoded_0xff.phpt
@@ -0,0 +1,12 @@
+--TEST--
+FILTER_SANITIZE_ENCODED percent-encodes 0xFF
+--EXTENSIONS--
+filter
+--FILE--
+<?php
+var_dump(filter_var("\xFF", FILTER_SANITIZE_ENCODED));
+var_dump(filter_var("\xFE\xFF\x00A", FILTER_SANITIZE_ENCODED));
+?>
+--EXPECT--
+string(3) "%FF"
+string(10) "%FE%FF%00A"