From 922b9d6798334a88c54b187ff956566d0b16ee0f Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date: Sun, 6 Oct 2024 17:10:12 +0200
Subject: [PATCH] Fix GH-16256: Assertion failure in
 ext/soap/php_encoding.c:460

The class map must be an associative array, not a packed array.

Closes GH-16269.
---
 NEWS                             |  2 ++
 ext/soap/soap.c                  |  6 ++++++
 ext/soap/tests/bugs/gh16256.phpt | 25 +++++++++++++++++++++++++
 3 files changed, 33 insertions(+)
 create mode 100644 ext/soap/tests/bugs/gh16256.phpt

diff --git a/NEWS b/NEWS
index 8392392cb97..cec98047e99 100644
--- a/NEWS
+++ b/NEWS
@@ -75,6 +75,8 @@ PHP                                                                        NEWS
   . Fixed bug #62900 (Wrong namespace on xsd import error message). (nielsdos)
   . Fixed bug GH-16237 (Segmentation fault when cloning SoapServer). (nielsdos)
   . Fix Soap leaking http_msg on error. (nielsdos)
+  . Fixed bug GH-16256 (Assertion failure in ext/soap/php_encoding.c:460).
+    (nielsdos)
 
 - Standard:
   . Fixed bug GH-15613 (overflow on unpack call hex string repeater).
diff --git a/ext/soap/soap.c b/ext/soap/soap.c
index 924e60deaa4..0996927cee0 100644
--- a/ext/soap/soap.c
+++ b/ext/soap/soap.c
@@ -838,6 +838,9 @@ PHP_METHOD(SoapServer, __construct)
 
 		if ((tmp = zend_hash_str_find(ht, "classmap", sizeof("classmap")-1)) != NULL &&
 			Z_TYPE_P(tmp) == IS_ARRAY) {
+			if (HT_IS_PACKED(Z_ARRVAL_P(tmp))) {
+				php_error_docref(NULL, E_ERROR, "'classmap' option must be an associative array");
+			}
 			service->class_map = zend_array_dup(Z_ARRVAL_P(tmp));
 		}
 
@@ -2004,6 +2007,9 @@ PHP_METHOD(SoapClient, __construct)
 		}
 		if ((tmp = zend_hash_str_find(ht, "classmap", sizeof("classmap")-1)) != NULL &&
 			Z_TYPE_P(tmp) == IS_ARRAY) {
+			if (HT_IS_PACKED(Z_ARRVAL_P(tmp))) {
+				php_error_docref(NULL, E_ERROR, "'classmap' option must be an associative array");
+			}
 			ZVAL_COPY(Z_CLIENT_CLASSMAP_P(this_ptr), tmp);
 		}
 
diff --git a/ext/soap/tests/bugs/gh16256.phpt b/ext/soap/tests/bugs/gh16256.phpt
new file mode 100644
index 00000000000..ca8c00af5bb
--- /dev/null
+++ b/ext/soap/tests/bugs/gh16256.phpt
@@ -0,0 +1,25 @@
+--TEST--
+GH-16256 (Assertion failure in ext/soap/php_encoding.c:460)
+--EXTENSIONS--
+soap
+--FILE--
+<?php
+$classmap = [
+    "bogus",
+];
+$wsdl = __DIR__."/ext/soap/tests/bug41004.wsdl";
+try {
+    new SoapClient($wsdl, ["classmap" => $classmap]);
+} catch (Throwable $e) {
+    echo $e->getMessage(), "\n";
+}
+try {
+    new SoapServer($wsdl, ["classmap" => $classmap]);
+} catch (Throwable $e) {
+    echo $e->getMessage(), "\n";
+}
+?>
+--EXPECT--
+SoapClient::__construct(): 'classmap' option must be an associative array
+<?xml version="1.0" encoding="UTF-8"?>
+<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"><SOAP-ENV:Body><SOAP-ENV:Fault><faultcode>SOAP-ENV:Server</faultcode><faultstring>SoapServer::__construct(): 'classmap' option must be an associative array</faultstring></SOAP-ENV:Fault></SOAP-ENV:Body></SOAP-ENV:Envelope>