From 5145912848dfacc957b649c7a44c159bb1f1edf4 Mon Sep 17 00:00:00 2001
From: Remi Collet <remi@remirepo.net>
Date: Wed, 18 Feb 2026 08:12:00 +0100
Subject: Fix Heap buffer overflow in array_merge()

  CVE-2025-14178
use oracle client library version 23.26 on x86_64 and aarch64
---
 php-cve-2025-14178.patch | 94 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 94 insertions(+)
 create mode 100644 php-cve-2025-14178.patch

(limited to 'php-cve-2025-14178.patch')

diff --git a/php-cve-2025-14178.patch b/php-cve-2025-14178.patch
new file mode 100644
index 0000000..5ce90c2
--- /dev/null
+++ b/php-cve-2025-14178.patch
@@ -0,0 +1,94 @@
+From 190eefda704550c49db7b9ec2b60369f1a4db1a8 Mon Sep 17 00:00:00 2001
+From: Niels Dossche <7771979+ndossche@users.noreply.github.com>
+Date: Sun, 9 Nov 2025 13:23:11 +0100
+Subject: [PATCH 1/2] Fix GHSA-h96m-rvf9-jgm2
+
+(cherry picked from commit 8b801151bd54b36aae4593ed6cfc096e8122b415)
+(cherry picked from commit e4516e52979e8b67d9d35dfdbcc5dc7368263fa2)
+(cherry picked from commit 84b83e2979bad57618528d4e669636117022f37c)
+(cherry picked from commit d8f3aac707341374fa8bffc90b76c0c8b0f6d1b0)
+---
+ ext/standard/array.c                             |  7 ++++++-
+ .../tests/array/GHSA-h96m-rvf9-jgm2.phpt         | 16 ++++++++++++++++
+ 2 files changed, 22 insertions(+), 1 deletion(-)
+ create mode 100644 ext/standard/tests/array/GHSA-h96m-rvf9-jgm2.phpt
+
+diff --git a/ext/standard/array.c b/ext/standard/array.c
+index 46e8340906..8da33a9d14 100644
+--- a/ext/standard/array.c
++++ b/ext/standard/array.c
+@@ -3836,7 +3836,7 @@ static inline void php_array_merge_or_replace_wrapper(INTERNAL_FUNCTION_PARAMETE
+ 	} else {
+ 		zval *src_entry;
+ 		HashTable *src, *dest;
+-		uint32_t count = 0;
++		uint64_t count = 0;
+ 
+ 		for (i = 0; i < argc; i++) {
+ 			zval *arg = args + i;
+@@ -3848,6 +3848,11 @@ static inline void php_array_merge_or_replace_wrapper(INTERNAL_FUNCTION_PARAMETE
+ 			count += zend_hash_num_elements(Z_ARRVAL_P(arg));
+ 		}
+ 
++		if (UNEXPECTED(count >= HT_MAX_SIZE)) {
++			zend_throw_error(NULL, "The total number of elements must be lower than %u", HT_MAX_SIZE);
++			return;
++		}
++
+ 		arg = args;
+ 		src  = Z_ARRVAL_P(arg);
+ 		/* copy first array */
+diff --git a/ext/standard/tests/array/GHSA-h96m-rvf9-jgm2.phpt b/ext/standard/tests/array/GHSA-h96m-rvf9-jgm2.phpt
+new file mode 100644
+index 0000000000..2e3e85357e
+--- /dev/null
++++ b/ext/standard/tests/array/GHSA-h96m-rvf9-jgm2.phpt
+@@ -0,0 +1,16 @@
++--TEST--
++GHSA-h96m-rvf9-jgm2
++--FILE--
++<?php
++
++$power = 20; // Chosen to be well within a memory_limit
++$arr = range(0, 2**$power);
++try {
++    array_merge(...array_fill(0, 2**(32-$power), $arr));
++} catch (Error $e) {
++    echo $e->getMessage(), "\n";
++}
++
++?>
++--EXPECTF--
++The total number of elements must be lower than %d
+-- 
+2.53.0
+
+From 77eb44b9f1c24c44f3bc8c9b4e04200db935f91d Mon Sep 17 00:00:00 2001
+From: Remi Collet <remi@remirepo.net>
+Date: Tue, 17 Feb 2026 15:48:22 +0100
+Subject: [PATCH 2/2] NEWS
+
+(cherry picked from commit 143f4339e80c13ffa1b11aae7f629807c9442edc)
+---
+ NEWS | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/NEWS b/NEWS
+index cc2d877d94..18217680a1 100644
+--- a/NEWS
++++ b/NEWS
+@@ -1,6 +1,11 @@
+ PHP                                                                        NEWS
+ |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
+ 
++Backported from 8.1.34
++
++  . Fixed GHSA-h96m-rvf9-jgm2 (Heap buffer overflow in array_merge()).
++    (CVE-2025-14178) (ndossche)
++
+ Backported from 8.1.31
+ 
+ - CLI:
+-- 
+2.53.0
+
-- 
cgit