Fixed bug #50219 (soap call Segmentation fault on a redirected url).

diff --git a/NEWS b/NEWS
index 6527b033d57e86f62b6f69834ab83fe870e0296a..7bd421c54c575bca406eec0bb35fdf64fd27bf8f 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -24,6 +24,8 @@ PHP                                                                        NEWS
   (Pierre)
 
 
+- Fixed bug #50219 (soap call Segmentation fault on a redirected url).
+  (Pierrick)
 - Fixed bug #50212 (crash by ldap_get_option() with LDAP_OPT_NETWORK_TIMEOUT).
   (Ilia, shigeru_kitazaki at cybozu dot co dot jp)
 - Fixed bug #50207 (segmentation fault when concatenating very large strings on

diff --git a/ext/soap/php_http.c b/ext/soap/php_http.c
index 563087a31d2d84a0ed6aad9f977ef8a226ece61e..f0b00dc6d1a40ae06c093dc922e87dbd9743a534 100644 (file)
--- a/ext/soap/php_http.c
+++ b/ext/soap/php_http.c
@@ -990,12 +990,20 @@ try_again:
                                        new_url->host = phpurl->host ? estrdup(phpurl->host) : NULL;
                                        new_url->port = phpurl->port;
                                        if (new_url->path && new_url->path[0] != '/') {
-                                               char *t = phpurl->path;
-                                               char *p = strrchr(t, '/');
-                                               if (p) {
-                                                       char *s = emalloc((p - t) + strlen(new_url->path) + 2);
-                                                       strncpy(s, t, (p - t) + 1);
-                                                       s[(p - t) + 1] = 0;
+                                               if (phpurl->path) {
+                                                       char *t = phpurl->path;
+                                                       char *p = strrchr(t, '/');
+                                                       if (p) {
+                                                               char *s = emalloc((p - t) + strlen(new_url->path) + 2);
+                                                               strncpy(s, t, (p - t) + 1);
+                                                               s[(p - t) + 1] = 0;
+                                                               strcat(s, new_url->path);
+                                                               efree(new_url->path);
+                                                               new_url->path = s;
+                                                       } 
+                                               } else {
+                                                       char *s = emalloc(strlen(new_url->path) + 2);
+                                                       s[0] = '/'; s[1] = 0;
                                                        strcat(s, new_url->path);
                                                        efree(new_url->path);
                                                        new_url->path = s;