From 04dab6086e270ad57ae5e284953f63a2887b3e94 Mon Sep 17 00:00:00 2001
From: lazerg <lazerg2@gmail.com>
Date: Sat, 31 Oct 2026 22:24:08 +0500
Subject: [PATCH 1/2] Fix GH-25094: NULL dereference in SOAP get_doc_function()
 with missing parts

---
 ext/soap/soap.c             |  4 ++++
 ext/soap/tests/gh25094.phpt | 27 +++++++++++++++++++++++++
 ext/soap/tests/gh25094.wsdl | 39 +++++++++++++++++++++++++++++++++++++
 3 files changed, 70 insertions(+)
 create mode 100644 ext/soap/tests/gh25094.phpt
 create mode 100644 ext/soap/tests/gh25094.wsdl

diff --git a/ext/soap/soap.c b/ext/soap/soap.c
index eb35cfc72650..3bba56782f3b 100644
--- a/ext/soap/soap.c
+++ b/ext/soap/soap.c
@@ -4284,6 +4284,10 @@ static sdlFunctionPtr get_doc_function(sdlPtr sdl, xmlNodePtr params) /* {{{ */
 						xmlNodePtr node = params;
 
 						ZEND_HASH_FOREACH_PTR(tmp->requestParameters, param) {
+							if (node == NULL) {
+								ok = 0;
+								break;
+							}
 							if (param->element) {
 								if (strcmp(param->element->name, (char*)node->name) != 0) {
 									ok = 0;
diff --git a/ext/soap/tests/gh25094.phpt b/ext/soap/tests/gh25094.phpt
new file mode 100644
index 000000000000..1e5a0540c8fd
--- /dev/null
+++ b/ext/soap/tests/gh25094.phpt
@@ -0,0 +1,27 @@
+--TEST--
+GH-25094 (NULL pointer dereference in get_doc_function() when the request has fewer parts than the WSDL)
+--EXTENSIONS--
+soap
+--INI--
+soap.wsdl_cache_enabled=0
+--FILE--
+<?php
+class TestService {
+    public function Test($a, $b) {
+        return $a;
+    }
+}
+
+$server = new SoapServer(__DIR__ . '/gh25094.wsdl');
+$server->setClass('TestService');
+
+$server->handle(<<<'XML'
+<?xml version="1.0"?>
+<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:tns="http://test-uri">
+  <SOAP-ENV:Body><tns:a>foo</tns:a></SOAP-ENV:Body>
+</SOAP-ENV:Envelope>
+XML);
+?>
+--EXPECT--
+<?xml version="1.0" encoding="UTF-8"?>
+<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"><SOAP-ENV:Body><SOAP-ENV:Fault><faultcode>SOAP-ENV:Server</faultcode><faultstring>Procedure 'a' not present</faultstring></SOAP-ENV:Fault></SOAP-ENV:Body></SOAP-ENV:Envelope>
diff --git a/ext/soap/tests/gh25094.wsdl b/ext/soap/tests/gh25094.wsdl
new file mode 100644
index 000000000000..b7865b2db582
--- /dev/null
+++ b/ext/soap/tests/gh25094.wsdl
@@ -0,0 +1,39 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<definitions xmlns="http://schemas.xmlsoap.org/wsdl/"
+             xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/"
+             xmlns:xsd="http://www.w3.org/2001/XMLSchema"
+             xmlns:tns="http://test-uri"
+             targetNamespace="http://test-uri">
+  <types>
+    <xsd:schema targetNamespace="http://test-uri" elementFormDefault="qualified">
+      <xsd:element name="a" type="xsd:string"/>
+      <xsd:element name="b" type="xsd:string"/>
+    </xsd:schema>
+  </types>
+  <message name="TestRequest">
+    <part name="a" element="tns:a"/>
+    <part name="b" element="tns:b"/>
+  </message>
+  <message name="TestResponse">
+    <part name="r" element="tns:a"/>
+  </message>
+  <portType name="TestPortType">
+    <operation name="Test">
+      <input message="tns:TestRequest"/>
+      <output message="tns:TestResponse"/>
+    </operation>
+  </portType>
+  <binding name="TestBinding" type="tns:TestPortType">
+    <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
+    <operation name="Test">
+      <soap:operation soapAction="http://test-uri/Test"/>
+      <input><soap:body use="literal"/></input>
+      <output><soap:body use="literal"/></output>
+    </operation>
+  </binding>
+  <service name="TestService">
+    <port name="TestPort" binding="tns:TestBinding">
+      <soap:address location="http://localhost/test"/>
+    </port>
+  </service>
+</definitions>

From 9e213bde7fa108a43314f7b2661bd29faca4137a Mon Sep 17 00:00:00 2001
From: lazerg <lazerg2@gmail.com>
Date: Sun, 1 Nov 2026 16:37:30 +0500
Subject: [PATCH 2/2] Add CREDITS to gh25094.phpt

---
 ext/soap/tests/gh25094.phpt | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/ext/soap/tests/gh25094.phpt b/ext/soap/tests/gh25094.phpt
index 1e5a0540c8fd..59ad67d8789c 100644
--- a/ext/soap/tests/gh25094.phpt
+++ b/ext/soap/tests/gh25094.phpt
@@ -1,5 +1,7 @@
 --TEST--
 GH-25094 (NULL pointer dereference in get_doc_function() when the request has fewer parts than the WSDL)
+--CREDITS--
+cxxz16
 --EXTENSIONS--
 soap
 --INI--