From 19b22252741035f094e45d77253eeedbd69c0dd4 Mon Sep 17 00:00:00 2001 From: Honey Tyagi Date: Thu, 22 Oct 2026 22:00:39 +0530 Subject: [PATCH] Fix GH-23876: make JSON_INVALID_UTF8_* flags mutually exclusive in json_decode --- ext/json/json.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/ext/json/json.c b/ext/json/json.c index dbae11c98f40..7e2fe21d8488 100644 --- a/ext/json/json.c +++ b/ext/json/json.c @@ -321,6 +321,11 @@ PHP_FUNCTION(json_decode) RETURN_THROWS(); } + if ((options & PHP_JSON_INVALID_UTF8_IGNORE) && (options & PHP_JSON_INVALID_UTF8_SUBSTITUTE)) { + zend_argument_value_error(4, "JSON_INVALID_UTF8_IGNORE and JSON_INVALID_UTF8_SUBSTITUTE are mutually exclusive"); + RETURN_THROWS(); + } + /* For BC reasons, the bool $assoc overrides the long $options bit for PHP_JSON_OBJECT_AS_ARRAY */ if (!assoc_null) { if (assoc) {