Fixed bug #75502

The string keys were not duplicated into persistent memory in this
case.

diff --git a/NEWS b/NEWS
index 5a69457c80b0c8298e6a7d68a4bf45f1a937db0e..0219e168f3b2f74ceed275aafa5f0e580b3b1996 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -21,6 +21,7 @@ PHP                                                                        NEWS
 - SOAP:
   . Fixed bug #70469 (SoapClient generates E_ERROR even if exceptions=1 is
     used). (Anton Artamonov)
+  . Fixed bug #75502 (Segmentation fault in zend_string_release). (Nikita)
 
 - SPL:
   . Fixed bug #75717 (RecursiveArrayIterator does not traverse arrays by

diff --git a/ext/soap/php_sdl.c b/ext/soap/php_sdl.c
index b8f1911f6972278d0cc68f3fa66597da3a9e277f..eb22a0fa855ed841ffe74c1b801906075bc6a70f 100644 (file)
--- a/ext/soap/php_sdl.c
+++ b/ext/soap/php_sdl.c
@@ -2397,12 +2397,6 @@ static void make_persistent_restriction_char_int(sdlRestrictionCharPtr *rest)
 }
 
 
-static void make_persistent_restriction_char(zval *zv)
-{
-       make_persistent_restriction_char_int((sdlRestrictionCharPtr*)&Z_PTR_P(zv));
-}
-
-
 static void make_persistent_sdl_type_ref(sdlTypePtr *type, HashTable *ptr_map, HashTable *bp_types)
 {
        sdlTypePtr tmp;
@@ -2764,9 +2758,15 @@ static sdlTypePtr make_persistent_sdl_type(sdlTypePtr type, HashTable *ptr_map,
                }
 
                if (type->restrictions->enumeration) {
+                       sdlRestrictionCharPtr tmp, penum;
                        ptype->restrictions->enumeration = malloc(sizeof(HashTable));
                        zend_hash_init(ptype->restrictions->enumeration, zend_hash_num_elements(type->restrictions->enumeration), NULL, delete_restriction_var_char_persistent, 1);
-                       zend_hash_copy(ptype->restrictions->enumeration, type->restrictions->enumeration, make_persistent_restriction_char);
+                       ZEND_HASH_FOREACH_STR_KEY_PTR(type->restrictions->enumeration, key, tmp) {
+                               penum = tmp;
+                               make_persistent_restriction_char_int(&penum);
+                               /* We have to duplicate key emalloc->malloc */
+                               zend_hash_str_add_ptr(ptype->restrictions->enumeration, ZSTR_VAL(key), ZSTR_LEN(key), penum);
+                       } ZEND_HASH_FOREACH_END();
                }
        }
 

diff --git a/ext/soap/tests/bugs/bug75502.phpt b/ext/soap/tests/bugs/bug75502.phpt
new file mode 100644 (file)
index 0000000..43cd800
--- /dev/null
+++ b/ext/soap/tests/bugs/bug75502.phpt
@@ -0,0 +1,16 @@
+--TEST--
+Bug #75502 (Segmentation fault in zend_string_release)
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--INI--
+soap.wsdl_cache_enabled=1
+soap.wsdl_cache=2
+--FILE--
+<?php
+/* The important part is that restriction>enumeration is used together with mem cache.
+ * Reuse a WSDL file contains this. */
+$client = new SoapClient(dirname(__FILE__)."/bug29236.wsdl");
+?>
+===DONE===
+--EXPECT--
+===DONE===