From: Dmitry Stogov <dmitry@php.net>
Date: Mon, 28 Nov 2011 14:20:35 +0000 (+0000)
Subject: Fixed bug #54911 (Access to a undefined member in inherit SoapClient may cause Segmen... 
X-Git-Tag: php-5.5.0alpha1~800
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=a2ac3a6f26cf554141301c64adf72fd1acb107ae;p=php

Fixed bug #54911 (Access to a undefined member in inherit SoapClient may cause Segmentation Fault)
---

diff --git a/ext/soap/soap.c b/ext/soap/soap.c
index f9adb3fb2f..bd2cb5d289 100644
--- a/ext/soap/soap.c
+++ b/ext/soap/soap.c
@@ -93,6 +93,7 @@ static void soap_error_handler(int error_num, const char *error_filename, const
 	zend_bool _old_in_compilation = CG(in_compilation); \
 	zend_bool _old_in_execution = EG(in_execution); \
 	zend_execute_data *_old_current_execute_data = EG(current_execute_data); \
+	void **_old_stack_top = EG(argument_stack)->top; \
 	int _bailout = 0;\
 	SOAP_GLOBAL(use_soap_error_handler) = 1;\
 	SOAP_GLOBAL(error_code) = "Client";\
@@ -109,6 +110,16 @@ static void soap_error_handler(int error_num, const char *error_filename, const
 		    !instanceof_function(Z_OBJCE_P(EG(exception)), soap_fault_class_entry TSRMLS_CC)) {\
 			_bailout = 1;\
 		}\
+		if (_old_stack_top != EG(argument_stack)->top) { \
+			while (EG(argument_stack)->prev != NULL && \
+			       ((char*)_old_stack_top < (char*)EG(argument_stack) || \
+			        (char*) _old_stack_top > (char*)EG(argument_stack)->end)) { \
+				zend_vm_stack tmp = EG(argument_stack)->prev; \
+				efree(EG(argument_stack)); \
+				EG(argument_stack) = tmp; \
+			} \
+			EG(argument_stack)->top = _old_stack_top; \
+		} \
 	} zend_end_try();\
 	SOAP_GLOBAL(use_soap_error_handler) = _old_handler;\
 	SOAP_GLOBAL(error_code) = _old_error_code;\
diff --git a/ext/soap/tests/bugs/bug54911.phpt b/ext/soap/tests/bugs/bug54911.phpt
new file mode 100644
index 0000000000..da57383ac7
--- /dev/null
+++ b/ext/soap/tests/bugs/bug54911.phpt
@@ -0,0 +1,22 @@
+--TEST--
+Bug #54911 (Access to a undefined member in inherit SoapClient may cause Segmentation Fault)
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+    class XSoapClient extends SoapClient {
+        function __doRequest($request, $location, $action, $version, $one_way=false) {
+            echo self::$crash;
+        }   
+    }   
+    $client = new XSoapClient(null, array('uri'=>'', 'location'=>''));
+    $client->__soapCall('', array());
+?>
+--EXPECTF--
+Fatal error: Uncaught SoapFault exception: [Client] Access to undeclared static property: XSoapClient::$crash in %sbug54911.php:4
+Stack trace:
+#0 %sbug54911.php(4): XSoapClient::__doRequest()
+#1 [internal function]: XSoapClient->__doRequest('<?xml version="...', '', '#', 1, 0)
+#2 %sbug54911.php(8): SoapClient->__soapCall('', Array)
+#3 {main}
+  thrown in %sbug54911.php on line 4
\ No newline at end of file