From dc6305a00e34cc908165b5d6f6df266abee6dff3 Mon Sep 17 00:00:00 2001
From: Lazizbek Ergashev <lazerg2@gmail.com>
Date: Tue, 25 Aug 2026 21:22:12 +0500
Subject: [PATCH 1/2] Fix GH-23453: bad free with a context engine ID longer
 than 32 bytes

---
 NEWS                        |  4 ++++
 ext/snmp/snmp.c             |  3 ++-
 ext/snmp/tests/gh23453.phpt | 17 +++++++++++++++++
 3 files changed, 23 insertions(+), 1 deletion(-)
 create mode 100644 ext/snmp/tests/gh23453.phpt

diff --git a/NEWS b/NEWS
index 5607f31081b8..531a17d750c5 100644
--- a/NEWS
+++ b/NEWS
@@ -45,6 +45,10 @@ PHP                                                                        NEWS
   . Fixed a leak when a persistent connection failed a liveness check
     with no other live PDO handle. (iliaal)
 
+- SNMP:
+  . Fixed bug GH-23453 (SNMP::setSecurity() frees a non-malloced address with a
+    context engine ID longer than 32 bytes). (Lazizbek Ergashev)
+
 - Standard:
   . Fixed a memory leak in array_merge_recursive() when the recursive merge of
     an object converted to an array fails. (David Carlier)
diff --git a/ext/snmp/snmp.c b/ext/snmp/snmp.c
index afbdda285ec4..6277c1f3f728 100644
--- a/ext/snmp/snmp.c
+++ b/ext/snmp/snmp.c
@@ -1086,7 +1086,8 @@ static bool netsnmp_session_set_contextEngineID(struct snmp_session *s, zend_str
 	size_t	ebuf_len = 32, eout_len = 0;
 	uint8_t	*ebuf = (uint8_t *) emalloc(ebuf_len);
 
-	if (!snmp_hex_to_binary(&ebuf, &ebuf_len, &eout_len, 1, ZSTR_VAL(contextEngineID))) {
+	/* Disallow reallocation: ebuf comes from emalloc() and net-snmp would realloc() it. */
+	if (!snmp_hex_to_binary(&ebuf, &ebuf_len, &eout_len, 0, ZSTR_VAL(contextEngineID))) {
 		// TODO Promote to Error?
 		php_error_docref(NULL, E_WARNING, "Bad engine ID value '%s'", ZSTR_VAL(contextEngineID));
 		efree(ebuf);
diff --git a/ext/snmp/tests/gh23453.phpt b/ext/snmp/tests/gh23453.phpt
new file mode 100644
index 000000000000..090c97235fa7
--- /dev/null
+++ b/ext/snmp/tests/gh23453.phpt
@@ -0,0 +1,17 @@
+--TEST--
+GH-23453 (ext/snmp: Attempted free on non-malloced address)
+--EXTENSIONS--
+snmp
+--FILE--
+<?php
+$session = new SNMP(SNMP::VERSION_3, 'localhost', 'user');
+
+// 32 bytes is the maximum length of a context engine ID
+var_dump($session->setSecurity('authPriv', 'SHA', 'authpassword12345', 'AES', 'privpassword12345', 'myContext', str_repeat('aa', 32)));
+var_dump($session->setSecurity('authPriv', 'SHA', 'authpassword12345', 'AES', 'privpassword12345', 'myContext', str_repeat('aa', 33)));
+?>
+--EXPECTF--
+bool(true)
+
+Warning: SNMP::setSecurity(): Bad engine ID value 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' in %s on line %d
+bool(false)

From afd9fc4ac5daa1bed968b948c914206bddf7c8b8 Mon Sep 17 00:00:00 2001
From: Lazizbek Ergashev <lazerg2@gmail.com>
Date: Tue, 25 Aug 2026 22:20:52 +0500
Subject: [PATCH 2/2] Use a behavioural description in the GH-23453 test title

---
 ext/snmp/tests/gh23453.phpt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ext/snmp/tests/gh23453.phpt b/ext/snmp/tests/gh23453.phpt
index 090c97235fa7..aaa89baad182 100644
--- a/ext/snmp/tests/gh23453.phpt
+++ b/ext/snmp/tests/gh23453.phpt
@@ -1,5 +1,5 @@
 --TEST--
-GH-23453 (ext/snmp: Attempted free on non-malloced address)
+GH-23453 (SNMP::setSecurity() frees a non-malloced address with a context engine ID longer than 32 bytes)
 --EXTENSIONS--
 snmp
 --FILE--