Commit 65d9f8a3a98 for php.net

commit 65d9f8a3a98238a4b76ea1ffdd803673528c7b4e
Merge: fa1faaaac7f b003ae80cf3
Author: David Carlier <devnexen@gmail.com>
Date:   Mon Sep 7 21:07:48 2026 +0100

    Merge branch 'PHP-8.5'

    * PHP-8.5:
      Fix GH-23453: bad free with a context engine ID longer than 32 bytes

    # Conflicts:
    #       ext/snmp/snmp.c

diff --cc ext/snmp/snmp.c
index 94b7d803a03,672ac9a94b4..0c060739236
--- a/ext/snmp/snmp.c
+++ b/ext/snmp/snmp.c
@@@ -1158,8 -1130,10 +1158,9 @@@ static bool snmp_session_set_contextEng
  	size_t	ebuf_len = 32, eout_len = 0;
  	uint8_t	*ebuf = (uint8_t *) emalloc(ebuf_len);

- 	if (!snmp_hex_to_binary(&ebuf, &ebuf_len, &eout_len, 1, ZSTR_VAL(contextEngineID))) {
+ 	/* Disallow reallocation: ebuf comes from emalloc() and net-snmp would realloc() it. */
+ 	if (!snmp_hex_to_binary(&ebuf, &ebuf_len, &eout_len, 0, ZSTR_VAL(contextEngineID))) {
 -		// TODO Promote to Error?
 -		php_error_docref(NULL, E_WARNING, "Bad engine ID value '%s'", ZSTR_VAL(contextEngineID));
 +		zend_argument_value_error(context_engine_id_arg_num, "must be a valid context engine ID");
  		efree(ebuf);
  		return false;
  	}
diff --cc ext/snmp/tests/gh23453.phpt
index 00000000000,aaa89baad18..19327791fa9
mode 000000,100644..100644
--- a/ext/snmp/tests/gh23453.phpt
+++ b/ext/snmp/tests/gh23453.phpt
@@@ -1,0 -1,17 +1,19 @@@
+ --TEST--
+ GH-23453 (SNMP::setSecurity() frees a non-malloced address with a context engine ID longer than 32 bytes)
+ --EXTENSIONS--
+ snmp
+ --FILE--
+ <?php
+ $session = new SNMP(SNMP::VERSION_3, 'localhost', 'user');
+
+ // 32 bytes is the maximum length of a context engine ID
+ var_dump($session->setSecurity('authPriv', 'SHA', 'authpassword12345', 'AES', 'privpassword12345', 'myContext', str_repeat('aa', 32)));
 -var_dump($session->setSecurity('authPriv', 'SHA', 'authpassword12345', 'AES', 'privpassword12345', 'myContext', str_repeat('aa', 33)));
++try {
++    var_dump($session->setSecurity('authPriv', 'SHA', 'authpassword12345', 'AES', 'privpassword12345', 'myContext', str_repeat('aa', 33)));
++} catch (\ValueError $e) {
++    echo $e::class, ': ', $e->getMessage(), \PHP_EOL;
++}
+ ?>
 ---EXPECTF--
++--EXPECT--
+ bool(true)
 -
 -Warning: SNMP::setSecurity(): Bad engine ID value 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' in %s on line %d
 -bool(false)
++ValueError: SNMP::setSecurity(): Argument #7 ($contextEngineId) must be a valid context engine ID