BUGFIX: Prevent crash on error in send_http_soap_request()

diff --git a/ext/soap/php_http.c b/ext/soap/php_http.c
index cfe0f7ac4c2a282adf31c1a3bcbc3814c994196f..0d6982f81f535ca60c081e6e36c17ff79830d84e 100644 (file)
--- a/ext/soap/php_http.c
+++ b/ext/soap/php_http.c
@@ -217,7 +217,6 @@ int send_http_soap_request(zval *this_ptr, char *buf, int buf_size, char *locati
          if (phpurl != NULL) {
                php_url_free(phpurl);
          }
-               xmlFree(buf);
                add_soap_fault(this_ptr, "HTTP", "Unable to parse URL", NULL, NULL TSRMLS_CC);
                return FALSE;
        }
@@ -226,14 +225,12 @@ int send_http_soap_request(zval *this_ptr, char *buf, int buf_size, char *locati
        if (phpurl->scheme != NULL && strcmp(phpurl->scheme, "https") == 0) {
                use_ssl = 1;
        } else if (phpurl->scheme == NULL || strcmp(phpurl->scheme, "http") != 0) {
-               xmlFree(buf);
                php_url_free(phpurl);
                add_soap_fault(this_ptr, "HTTP", "Unknown protocol. Only http and https are allowed.", NULL, NULL TSRMLS_CC);
                return FALSE;
        }
 #ifdef ZEND_ENGINE_2
        if (use_ssl && php_stream_locate_url_wrapper("https://", NULL, STREAM_LOCATE_WRAPPERS_ONLY TSRMLS_CC) == NULL) {
-               xmlFree(buf);
                php_url_free(phpurl);
                add_soap_fault(this_ptr, "HTTP", "SSL support not available in this build", NULL, NULL TSRMLS_CC);
                return FALSE;
@@ -241,7 +238,6 @@ int send_http_soap_request(zval *this_ptr, char *buf, int buf_size, char *locati
 #else
 #ifndef HAVE_OPENSSL_EXT
        if (use_ssl) {
-               xmlFree(buf);
                php_url_free(phpurl);
                add_soap_fault(this_ptr, "HTTP", "SSL support not available in this build", NULL, NULL TSRMLS_CC);
                return FALSE;
@@ -291,7 +287,6 @@ int send_http_soap_request(zval *this_ptr, char *buf, int buf_size, char *locati
                        add_property_resource(this_ptr, "httpsocket", php_stream_get_resource_id(stream));
                        add_property_long(this_ptr, "_use_proxy", use_proxy);
                } else {
-                       xmlFree(buf);
                        php_url_free(phpurl);
                        add_soap_fault(this_ptr, "HTTP", "Could not connect to host", NULL, NULL TSRMLS_CC);
                        return FALSE;
@@ -382,7 +377,6 @@ int send_http_soap_request(zval *this_ptr, char *buf, int buf_size, char *locati
                                        request_size = Z_STRLEN(retval);
                                } else {
                                        if (request != buf) {efree(request);}
-                                       xmlFree(buf);
                                        smart_str_free(&soap_headers);
                                        php_stream_close(stream);
                                        zend_hash_del(Z_OBJPROP_P(this_ptr), "httpurl", sizeof("httpurl"));
@@ -471,7 +465,6 @@ int send_http_soap_request(zval *this_ptr, char *buf, int buf_size, char *locati
                err = php_stream_write(stream, soap_headers.c, soap_headers.len);
                if (err != soap_headers.len) {
                        if (request != buf) {efree(request);}
-                       xmlFree(buf);
                        smart_str_free(&soap_headers);
                        php_stream_close(stream);
                        zend_hash_del(Z_OBJPROP_P(this_ptr), "httpurl", sizeof("httpurl"));

diff --git a/ext/soap/soap.c b/ext/soap/soap.c
index 0ac81721bf69a8da829ace886507851be371a0d5..315db5ec87cdd96db99d3f114f1cf8c39f010852 100644 (file)
--- a/ext/soap/soap.c
+++ b/ext/soap/soap.c
@@ -1924,6 +1924,7 @@ static int do_request(zval *this_ptr, xmlDoc *request, char *location, char *act
   zval   func;
        zval  *params[4];
        zval **trace;
+       zval **fault;
 
        INIT_ZVAL(*response);
 
@@ -1959,6 +1960,9 @@ static int do_request(zval *this_ptr, xmlDoc *request, char *location, char *act
                add_property_stringl(this_ptr, "__last_response", Z_STRVAL_P(response), Z_STRLEN_P(response), 1);
        }
        xmlFree(buf);
+       if (ret && zend_hash_find(Z_OBJPROP_P(this_ptr), "__soap_fault", sizeof("__soap_fault"), (void **) &fault) == SUCCESS) {
+         return FALSE;
+       }         
   return ret;
 }