From 86da63d7722ee049630da79a0ca68f9ec8ed20cb Mon Sep 17 00:00:00 2001
From: Weilin Du <weilindu@php.net>
Date: Sat, 18 Jul 2026 23:31:37 +0800
Subject: [PATCH] ext/gmp: Fix GMP accepting integer strings with NUL bytes

---
 ext/gmp/gmp.c                     |  9 +++++++++
 ext/gmp/tests/gmp_null_bytes.phpt | 28 ++++++++++++++++++++++++++++
 2 files changed, 37 insertions(+)
 create mode 100644 ext/gmp/tests/gmp_null_bytes.phpt

diff --git a/ext/gmp/gmp.c b/ext/gmp/gmp.c
index b05706e48297..a5cbdba3484e 100644
--- a/ext/gmp/gmp.c
+++ b/ext/gmp/gmp.c
@@ -644,6 +644,15 @@ static zend_result convert_zstr_to_gmp(mpz_t gmp_number, const zend_string *val,
 	const char *num_str = ZSTR_VAL(val);
 	bool skip_lead = false;
 
+	if (UNEXPECTED(zend_str_has_nul_byte(val))) {
+		if (arg_pos == 0) {
+			zend_value_error("Number is not an integer string");
+		} else {
+			zend_argument_value_error(arg_pos, "is not an integer string");
+		}
+		return FAILURE;
+	}
+
 	size_t num_len = ZSTR_LEN(val);
 	while (isspace((unsigned char)*num_str)) {
 		++num_str;
diff --git a/ext/gmp/tests/gmp_null_bytes.phpt b/ext/gmp/tests/gmp_null_bytes.phpt
new file mode 100644
index 000000000000..1518d342dda2
--- /dev/null
+++ b/ext/gmp/tests/gmp_null_bytes.phpt
@@ -0,0 +1,28 @@
+--TEST--
+GMP rejects integer strings containing null bytes
+--EXTENSIONS--
+gmp
+--FILE--
+<?php
+
+$tests = [
+    'gmp_init' => fn() => gmp_init("123\0abc"),
+    'gmp_init prefix' => fn() => gmp_init("0x10\0ff"),
+    'gmp_add' => fn() => gmp_add("123\0abc", 1),
+    'constructor' => fn() => new GMP("123\0abc"),
+];
+
+foreach ($tests as $label => $test) {
+    try {
+        $test();
+    } catch (ValueError $e) {
+        echo $label, ": ", $e->getMessage(), PHP_EOL;
+    }
+}
+
+?>
+--EXPECT--
+gmp_init: gmp_init(): Argument #1 ($num) is not an integer string
+gmp_init prefix: gmp_init(): Argument #1 ($num) is not an integer string
+gmp_add: gmp_add(): Argument #1 ($num1) is not an integer string
+constructor: GMP::__construct(): Argument #1 ($num) is not an integer string