From: Nikita Popov <nikita.ppv@gmail.com>
Date: Mon, 1 Jan 2018 20:23:10 +0000 (+0100)
Subject: Fixed bug #75502
X-Git-Tag: php-7.1.14RC1~34
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=d534d59bd81798a9dfb0dd7bed2f0d1afe63fca6;p=php

Fixed bug #75502

The string keys were not duplicated into persistent memory in this
case.
---

diff --git a/NEWS b/NEWS
index 5a69457c80..0219e168f3 100644
--- a/NEWS
+++ b/NEWS
@@ -21,6 +21,7 @@ PHP                                                                        NEWS
 - SOAP:
   . Fixed bug #70469 (SoapClient generates E_ERROR even if exceptions=1 is
     used). (Anton Artamonov)
+  . Fixed bug #75502 (Segmentation fault in zend_string_release). (Nikita)
 
 - SPL:
   . Fixed bug #75717 (RecursiveArrayIterator does not traverse arrays by
diff --git a/ext/soap/php_sdl.c b/ext/soap/php_sdl.c
index b8f1911f69..eb22a0fa85 100644
--- a/ext/soap/php_sdl.c
+++ b/ext/soap/php_sdl.c
@@ -2397,12 +2397,6 @@ static void make_persistent_restriction_char_int(sdlRestrictionCharPtr *rest)
 }
 
 
-static void make_persistent_restriction_char(zval *zv)
-{
-	make_persistent_restriction_char_int((sdlRestrictionCharPtr*)&Z_PTR_P(zv));
-}
-
-
 static void make_persistent_sdl_type_ref(sdlTypePtr *type, HashTable *ptr_map, HashTable *bp_types)
 {
 	sdlTypePtr tmp;
@@ -2764,9 +2758,15 @@ static sdlTypePtr make_persistent_sdl_type(sdlTypePtr type, HashTable *ptr_map,
 		}
 
 		if (type->restrictions->enumeration) {
+			sdlRestrictionCharPtr tmp, penum;
 			ptype->restrictions->enumeration = malloc(sizeof(HashTable));
 			zend_hash_init(ptype->restrictions->enumeration, zend_hash_num_elements(type->restrictions->enumeration), NULL, delete_restriction_var_char_persistent, 1);
-			zend_hash_copy(ptype->restrictions->enumeration, type->restrictions->enumeration, make_persistent_restriction_char);
+			ZEND_HASH_FOREACH_STR_KEY_PTR(type->restrictions->enumeration, key, tmp) {
+				penum = tmp;
+				make_persistent_restriction_char_int(&penum);
+				/* We have to duplicate key emalloc->malloc */
+				zend_hash_str_add_ptr(ptype->restrictions->enumeration, ZSTR_VAL(key), ZSTR_LEN(key), penum);
+			} ZEND_HASH_FOREACH_END();
 		}
 	}
 
diff --git a/ext/soap/tests/bugs/bug75502.phpt b/ext/soap/tests/bugs/bug75502.phpt
new file mode 100644
index 0000000000..43cd800556
--- /dev/null
+++ b/ext/soap/tests/bugs/bug75502.phpt
@@ -0,0 +1,16 @@
+--TEST--
+Bug #75502 (Segmentation fault in zend_string_release)
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--INI--
+soap.wsdl_cache_enabled=1
+soap.wsdl_cache=2
+--FILE--
+<?php
+/* The important part is that restriction>enumeration is used together with mem cache.
+ * Reuse a WSDL file contains this. */
+$client = new SoapClient(dirname(__FILE__)."/bug29236.wsdl");
+?>
+===DONE===
+--EXPECT--
+===DONE===