From 8aecb118e8eeb6a3df40c694e9d324262bf260c3 Mon Sep 17 00:00:00 2001
From: Taylor Christian Newsome <86472964+SleepTheGod@users.noreply.github.com>
Date: Mon, 26 Oct 2026 23:17:36 -0400
Subject: [PATCH] Implement null byte checks for hostnames and addresses

Added checks to reject hostnames and addresses containing null bytes to mitigate CVE-2025-1220.
---
 main/network.c | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/main/network.c b/main/network.c
index 1eee7390a23a..5939463209a8 100644
--- a/main/network.c
+++ b/main/network.c
@@ -156,6 +156,21 @@ PHPAPI int php_network_getaddresses(const char *host, int socktype, struct socka
 	if (host == NULL) {
 		return 0;
 	}
+
+	/* CVE-2025-1220: reject hostnames containing null bytes */
+	{
+		size_t host_len = strlen(host);
+		if (memchr(host, '\0', host_len) != NULL) {
+			if (error_string) {
+				*error_string = ZSTR_INIT_LITERAL("The hostname must not contain null bytes", 0);
+				php_error_docref(NULL, E_WARNING, "%s", ZSTR_VAL(*error_string));
+			} else {
+				php_error_docref(NULL, E_WARNING, "The hostname must not contain null bytes");
+			}
+			return 0;
+		}
+	}
+
 #ifdef HAVE_GETADDRINFO
 	memset(&hints, '\0', sizeof(hints));
 
@@ -637,6 +652,11 @@ PHPAPI zend_result php_network_parse_network_address_with_port(const char *addr,
 	memset(in4, 0, sizeof(struct sockaddr_in));
 #endif
 
+	/* CVE-2025-1220: reject addresses containing null bytes */
+	if (memchr(addr, '\0', addrlen) != NULL) {
+		return FAILURE;
+	}
+
 	if (*addr == '[') {
 		colon = memchr(addr + 1, ']', addrlen-1);
 		if (!colon || colon[1] != ':') {