From 34ce66830a4e601010f03e62130ef546308fa764 Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date: Wed, 1 Oct 2025 15:22:38 +0200
Subject: [PATCH] Fix GH-20011: Array of SoapVar of unknown type causes crash
We "guess" the type in this case, consistent with what a SoapVar would
do outside of an array.
---
ext/soap/php_encoding.c | 5 +++++
ext/soap/tests/bugs/gh20011.phpt | 20 ++++++++++++++++++++
2 files changed, 25 insertions(+)
create mode 100644 ext/soap/tests/bugs/gh20011.phpt
diff --git a/ext/soap/php_encoding.c b/ext/soap/php_encoding.c
index 0b4b553d87540..2e03eac0f1b29 100644
--- a/ext/soap/php_encoding.c
+++ b/ext/soap/php_encoding.c
@@ -3584,6 +3584,11 @@ static encodePtr get_array_type(xmlNodePtr node, zval *array, smart_str *type)
soap_error0(E_ERROR, "Encoding: SoapVar has no 'enc_type' property");
}
cur_type = Z_LVAL_P(ztype);
+ if (cur_type == UNKNOWN_TYPE) {
+ /* Mimic guess_xml_convert() where we use the type of the data.
+ * UNDEFs are handled transparently as it will error out upon encoding the data. */
+ cur_type = Z_TYPE_P(Z_VAR_ENC_VALUE_P(tmp));
+ }
zval *zstype = Z_VAR_ENC_STYPE_P(tmp);
if (Z_TYPE_P(zstype) == IS_STRING) {
diff --git a/ext/soap/tests/bugs/gh20011.phpt b/ext/soap/tests/bugs/gh20011.phpt
new file mode 100644
index 0000000000000..cf40d813e6178
--- /dev/null
+++ b/ext/soap/tests/bugs/gh20011.phpt
@@ -0,0 +1,20 @@
+--TEST--
+GH-20011 (Array of SoapVar of unknown type causes crash)
+--EXTENSIONS--
+soap
+--FILE--
+ 'test://', 'uri' => 'http://soapinterop.org/']);
+$client->echoStringArray($array);
+?>
+--EXPECT--
+
+test string