Fixed Bug #36614 (Segfault when using Soap)

diff --git a/NEWS b/NEWS
index adebf83924b08b9fb91540b14180e7d41317967b..302643c7977ee010ecb03afe8a1d6b1c1162aa23 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -6,9 +6,10 @@ PHP                                                                        NEWS
 - Added overflow checks to wordwrap() function. (Ilia)
 - Removed the E_STRICT deprecation notice from "var". (Ilia)
 - Fixed debug_zval_dump() to support private and protected members. (Dmitry)
-- Fixed bug #36629 (SoapServer::handle() exits on SOAP faults). (Dmitry)
 - Fixed bug #36697 (Transparency is lost when using imagecreatetruecolor).
- (Pierre)
+  (Pierre)
+- Fixed bug #36629 (SoapServer::handle() exits on SOAP faults). (Dmitry)
+- Fixed Bug #36614 (Segfault when using Soap). (Dmitry)
 - Fixed bug #36568 (memory_limit setting on win32 has no effect). (Dmitry)
 - Fixed bug #35988 (Unknown persistent list entry type in module shutdown).
   (Dmitry)

diff --git a/ext/soap/php_schema.c b/ext/soap/php_schema.c
index aa04525cc8169ddd940d0610ac75cea6a95e7bbc..3753245bd51b4a2bc9d90779d0e63c8865c82383 100644 (file)
--- a/ext/soap/php_schema.c
+++ b/ext/soap/php_schema.c
@@ -2117,7 +2117,7 @@ static void schema_attribute_fixup(sdlCtx *ctx, sdlAttributePtr attr)
                }
                if (attr->name == NULL && attr->ref != NULL) {
                        char *name = strrchr(attr->ref, ':');
-                       if (*name) {
+                       if (name) {
                                attr->name = estrdup(name+1);
                        } else{
                                attr->name = estrdup(attr->ref);

diff --git a/ext/soap/tests/bugs/bug36614.phpt b/ext/soap/tests/bugs/bug36614.phpt
new file mode 100755 (executable)
index 0000000..ba67348
--- /dev/null
+++ b/ext/soap/tests/bugs/bug36614.phpt
@@ -0,0 +1,13 @@
+--TEST--
+Bug #36614 (Segfault when using Soap)
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--INI--
+soap.wsdl_cache_enabled=0
+--FILE--
+<?php
+$lo_soap = new SoapClient(dirname(__FILE__)."/bug36614.wsdl");
+echo "ok\n";
+?>
+--EXPECT--
+ok

diff --git a/ext/soap/tests/bugs/bug36614.wsdl b/ext/soap/tests/bugs/bug36614.wsdl
new file mode 100755 (executable)
index 0000000..ecf1b1b
--- /dev/null
+++ b/ext/soap/tests/bugs/bug36614.wsdl
@@ -0,0 +1,204 @@
+<?xml version="1.0" encoding="UTF-8" ?> 
+<definitions name="SonicMobile Web-Services" 
+   targetNamespace="http://soap.sonicmobile.com/sonicmobile.wsdl"
+   xmlns="http://schemas.xmlsoap.org/wsdl/" 
+   xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" 
+   xmlns:sonic="http://soap.sonicmobile.com/sonicmobile.wsdl"
+   xmlns:xsd="http://www.w3.org/2001/XMLSchema">
+
+    <types>
+        <xsd:schema xmlns="http://www.w3.org/2000/10/XMLSchema">
+            <import namespace="http://schemas.xmlsoap.org/soap/encoding/"/>
+            <complexType name="TransportCount">
+                <all>
+                    <element name="transport" type="string" />
+                    <element name="count" type="integer" />
+                    <element name="rate" type="integer" />
+                    <element name="last_message" type="integer" />
+                </all>
+            </complexType>                    
+            <complexType name="ArrayOfTransportCount">
+                <complexContent>
+                    <restriction base="soapenc:Array">
+                        <attribute ref="soapenc:arrayType" arrayType="TransportCount[]" />
+                    </restriction>
+                </complexContent>
+            </complexType>
+        </xsd:schema>
+    </types>
+    
+   <message name="userSendMessageRequest">
+     <part name="sourceUser" type="xsd:int"/>
+     <part name="password" type="xsd:string"/>
+     <part name="destinationUser" type="xsd:int"/>
+     <part name="content" type="xsd:string"/>
+     <part name="sendRepliesTo" type="xsd:string"/>
+     <part name="reference" type="xsd:string"/>
+   </message>
+
+   <message name="sendMessageRequest">
+     <part name="application" type="xsd:string"/>
+     <part name="password" type="xsd:string"/>
+     <part name="destination" type="xsd:string"/>
+     <part name="content" type="xsd:string"/>
+     <part name="reference" type="xsd:string"/>
+     <part name="requestSource" type="xsd:string"/>
+     <part name="customer" type="xsd:string"/>
+     <part name="class" type="xsd:string"/>
+   </message>
+
+   <message name="MessageResponse">
+     <part name="messageid" type="xsd:int"/>
+     <part name="response" type="xsd:string"/>
+   </message>
+
+   <message name="messageCountRequest">
+          <part name="password" type="xsd:string"/>
+   </message>
+
+   <message name="messageCountResponse">
+          <part name="transports" type="tns:ArrayOfTransportCount"/>
+   </message>
+   
+   <message name="serverStatusRequest">
+        <part name="password" type="xsd:string"/>
+    </message>
+    <message name="serverStatusResponse">
+        <part name="status_string" type="xsd:string"/>
+    </message>
+ 
+    <message name="flushGatewayRequest">
+        <part name="password" type="xsd:string"/>
+    </message>
+    <message name="flushGatewayResponse">
+        <part name="status_string" type="xsd:string"/>
+    </message>
+    
+   <portType name="SonicMobilePortType">
+     <operation name="userSendMessage">         
+       <input  message="sonic:userSendMessageRequest"/>
+       <output message="sonic:MessageResponse"/>
+     </operation>
+
+     <operation name="sendMessage">
+       <input  message="sonic:sendMessageRequest"/>
+       <output message="sonic:MessageResponse"/>
+     </operation>
+
+     <operation name="messageCount">
+            <input message="sonic:messageCountRequest"/>
+            <output message="sonic:messageCountResponse"/>
+     </operation>
+     
+     <operation name="serverStatus">
+         <input message="sonic:serverStatusRequest"/>
+         <output message="sonic:serverStatusResponse"/>
+     </operation>
+     
+     <operation name="flushGateway">
+         <input message="sonic:flushGatewayRequest"/>
+         <output message="sonic:flushGatewayResponse"/>
+     </operation>
+   </portType>
+
+   <binding name="SonicMobileBinding" type="sonic:SonicMobilePortType">
+     <soap:binding style="rpc" transport="http://schemas.xmlsoap.org/soap/http" />
+
+     <operation name="userSendMessage">
+       <soap:operation soapAction="http://soap.sonicmobile.com/SonicMobile/SOAP#userSendMessage"/>
+
+       <input>
+         <soap:body 
+           encodingStyle="http://schemas.xmlsoap.org/soap/encoding/" 
+           namespace="http://soap.sonicmobile.com/SonicMobile/SOAP" 
+           use="encoded" />
+       </input>
+       
+       <output>
+         <soap:body 
+           encodingStyle="http://schemas.xmlsoap.org/soap/encoding/" 
+           namespace="http://soap.sonicmobile.com/SonicMobile/SOAP"
+           use="encoded" />
+       </output>
+     </operation>
+
+     <operation name="sendMessage">
+       <soap:operation soapAction="http://soap.sonicmobile.com/SonicMobile/SOAP#sendMessage"/>
+
+       <input>
+         <soap:body 
+           encodingStyle="http://schemas.xmlsoap.org/soap/encoding/" 
+           namespace="http://soap.sonicmobile.com/SonicMobile/SOAP" 
+           use="encoded" />
+       </input>
+       
+       <output>
+         <soap:body 
+           encodingStyle="http://schemas.xmlsoap.org/soap/encoding/" 
+           namespace="http://soap.sonicmobile.com/SonicMobile/SOAP"
+           use="encoded" />
+       </output>
+     </operation>
+ 
+     <operation name="messageCount">
+       <soap:operation soapAction="http://soap.sonicmobile.com/SonicMobile/SOAP#messageCount"/>
+
+       <input>
+         <soap:body 
+           encodingStyle="http://schemas.xmlsoap.org/soap/encoding/" 
+           namespace="http://soap.sonicmobile.com/SonicMobile/SOAP" 
+           use="encoded" />
+       </input>
+       
+       <output>
+         <soap:body 
+           encodingStyle="http://schemas.xmlsoap.org/soap/encoding/" 
+           namespace="http://soap.sonicmobile.com/SonicMobile/SOAP"
+           use="encoded" />
+       </output>
+     </operation>
+     
+     <operation name="serverStatus">
+         <soap:operation soapAction="http://soap.sonicmobile.com/SonicMobile/SOAP#serverStatus"/>
+         
+         <input>
+             <soap:body 
+                        encodingStyle="http://schemas.xmlsoap.org/soap/encoding/" 
+                        namespace="http://soap.sonicmobile.com/SonicMobile/SOAP" 
+                        use="encoded" />
+         </input>
+         
+         <output>
+             <soap:body 
+                        encodingStyle="http://schemas.xmlsoap.org/soap/encoding/" 
+                        namespace="http://soap.sonicmobile.com/SonicMobile/SOAP"
+                        use="encoded" />
+         </output>
+     </operation>
+     
+     <operation name="flushGateway">
+         <soap:operation soapAction="http://soap.sonicmobile.com/SonicMobile/SOAP#flushGateway"/>
+         
+         <input>
+             <soap:body 
+                        encodingStyle="http://schemas.xmlsoap.org/soap/encoding/" 
+                        namespace="http://soap.sonicmobile.com/SonicMobile/SOAP" 
+                        use="encoded" />
+         </input>
+        <output>
+             <soap:body 
+                        encodingStyle="http://schemas.xmlsoap.org/soap/encoding/" 
+                        namespace="http://soap.sonicmobile.com/SonicMobile/SOAP"
+                        use="encoded" />
+         </output>
+     </operation>
+     
+   </binding>
+
+   <service name="SonicMobile">
+     <port name="SonicMobilePort" binding="sonic:SonicMobileBinding">
+       <soap:address location="http://soap.sonicmobile.com/"/>
+     </port>
+   </service>
+
+</definitions>

diff --git a/ext/soap/tests/bugs/bug36629.phpt b/ext/soap/tests/bugs/bug36629.phpt
index ae646c27f37adfb63114421ba5cef31fe5bc9ac2..08b74a5fca9eaad98d175cc782d657f3298ced8a 100755 (executable)
--- a/ext/soap/tests/bugs/bug36629.phpt
+++ b/ext/soap/tests/bugs/bug36629.phpt
@@ -1,5 +1,7 @@
 --TEST--
 Bug #36629 (SoapServer::handle() exits on SOAP faults)
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
 --FILE--
 <?php
 function test1() {