Fixed bug #54911 (Access to a undefined member in inherit SoapClient may cause Segmen...

diff --git a/ext/soap/soap.c b/ext/soap/soap.c
index f9adb3fb2fdb800ca051644da887e2e7538456c1..bd2cb5d289f9c3e4fade8d42b3478a9100d674c0 100644 (file)
--- a/ext/soap/soap.c
+++ b/ext/soap/soap.c
@@ -93,6 +93,7 @@ static void soap_error_handler(int error_num, const char *error_filename, const
        zend_bool _old_in_compilation = CG(in_compilation); \
        zend_bool _old_in_execution = EG(in_execution); \
        zend_execute_data *_old_current_execute_data = EG(current_execute_data); \
+       void **_old_stack_top = EG(argument_stack)->top; \
        int _bailout = 0;\
        SOAP_GLOBAL(use_soap_error_handler) = 1;\
        SOAP_GLOBAL(error_code) = "Client";\
@@ -109,6 +110,16 @@ static void soap_error_handler(int error_num, const char *error_filename, const
                    !instanceof_function(Z_OBJCE_P(EG(exception)), soap_fault_class_entry TSRMLS_CC)) {\
                        _bailout = 1;\
                }\
+               if (_old_stack_top != EG(argument_stack)->top) { \
+                       while (EG(argument_stack)->prev != NULL && \
+                              ((char*)_old_stack_top < (char*)EG(argument_stack) || \
+                               (char*) _old_stack_top > (char*)EG(argument_stack)->end)) { \
+                               zend_vm_stack tmp = EG(argument_stack)->prev; \
+                               efree(EG(argument_stack)); \
+                               EG(argument_stack) = tmp; \
+                       } \
+                       EG(argument_stack)->top = _old_stack_top; \
+               } \
        } zend_end_try();\
        SOAP_GLOBAL(use_soap_error_handler) = _old_handler;\
        SOAP_GLOBAL(error_code) = _old_error_code;\

diff --git a/ext/soap/tests/bugs/bug54911.phpt b/ext/soap/tests/bugs/bug54911.phpt
new file mode 100644 (file)
index 0000000..da57383
--- /dev/null
+++ b/ext/soap/tests/bugs/bug54911.phpt
@@ -0,0 +1,22 @@
+--TEST--
+Bug #54911 (Access to a undefined member in inherit SoapClient may cause Segmentation Fault)
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+    class XSoapClient extends SoapClient {
+        function __doRequest($request, $location, $action, $version, $one_way=false) {
+            echo self::$crash;
+        }   
+    }   
+    $client = new XSoapClient(null, array('uri'=>'', 'location'=>''));
+    $client->__soapCall('', array());
+?>
+--EXPECTF--
+Fatal error: Uncaught SoapFault exception: [Client] Access to undeclared static property: XSoapClient::$crash in %sbug54911.php:4
+Stack trace:
+#0 %sbug54911.php(4): XSoapClient::__doRequest()
+#1 [internal function]: XSoapClient->__doRequest('<?xml version="...', '', '#', 1, 0)
+#2 %sbug54911.php(8): SoapClient->__soapCall('', Array)
+#3 {main}
+  thrown in %sbug54911.php on line 4
\ No newline at end of file