From 1f1140a93a18cb242111e53cc0eff935763b7ea0 Mon Sep 17 00:00:00 2001
From: Antony Dovgal <tony2001@php.net>
Date: Mon, 12 Nov 2007 11:23:04 +0000
Subject: [PATCH] MFH: fix #42736 (xmlrpc_server_call_method() crashes)

---
 NEWS                           |  1 +
 ext/xmlrpc/tests/bug42736.phpt | 56 ++++++++++++++++++++++++++++++++++
 ext/xmlrpc/xmlrpc-epi-php.c    |  7 ++---
 3 files changed, 60 insertions(+), 4 deletions(-)
 create mode 100644 ext/xmlrpc/tests/bug42736.phpt

diff --git a/NEWS b/NEWS
index de323083d3..2e5fa50bc5 100644
--- a/NEWS
+++ b/NEWS
@@ -59,6 +59,7 @@ PHP                                                                        NEWS
 - Fixed bug #42848 (Status: header incorrect under FastCGI). (Dmitry)
 - Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
 - Fixed bug #42737 (preg_split('//u') triggers a E_NOTICE with newlines). (Nuno)
+- Fixed bug #42736 (xmlrpc_server_call_method() crashes). (Tony)
 - Fixed bug #42657 (ini_get() returns incorrect value when default is NULL).
   (Jani)
 - Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
diff --git a/ext/xmlrpc/tests/bug42736.phpt b/ext/xmlrpc/tests/bug42736.phpt
new file mode 100644
index 0000000000..b9a46cff5c
--- /dev/null
+++ b/ext/xmlrpc/tests/bug42736.phpt
@@ -0,0 +1,56 @@
+--TEST--
+Bug #42736 (xmlrpc_server_call_method() crashes)
+--SKIPIF--
+<?php if (!extension_loaded("xmlrpc")) print "skip"; ?>
+--FILE--
+<?php
+
+class SOAP_Array {
+	public function get($id){
+		return $this->add($id);
+	}
+}
+
+$xml = xmlrpc_server_create();
+
+$Myrequest = '<?xml version="1.0" encoding="UTF-8"?><methodCall><methodName>GetProducts</methodName><params><param><value><dateTime.iso8601>20060922T14:26:19</dateTime.iso8601></value></param></params></methodCall>';
+
+class MyClass {
+	function GetProducts($dummy, $time){
+		return array('faultString' => $time);
+	}
+}
+$myclass =  new MyClass();
+xmlrpc_server_register_method($xml, 'GetProducts', array($myclass, 'GetProducts'));
+$response = xmlrpc_server_call_method($xml, $Myrequest, null);
+
+var_dump($response);
+
+echo "Done\n";
+?>
+--EXPECTF--	
+string(402) "<?xml version="1.0" encoding="iso-8859-1"?>
+<methodResponse>
+<params>
+ <param>
+  <value>
+   <struct>
+    <member>
+     <name>faultString</name>
+     <value>
+      <array>
+       <data>
+        <value>
+         <dateTime.iso8601>20060922T14:26:19</dateTime.iso8601>
+        </value>
+       </data>
+      </array>
+     </value>
+    </member>
+   </struct>
+  </value>
+ </param>
+</params>
+</methodResponse>
+"
+Done
diff --git a/ext/xmlrpc/xmlrpc-epi-php.c b/ext/xmlrpc/xmlrpc-epi-php.c
index 423deb045f..f6fab62ed1 100644
--- a/ext/xmlrpc/xmlrpc-epi-php.c
+++ b/ext/xmlrpc/xmlrpc-epi-php.c
@@ -523,7 +523,7 @@ static XMLRPC_VALUE PHP_to_XMLRPC_worker (const char* key, zval* in_val, int dep
                              break;
                          case HASH_KEY_IS_STRING:
                          case HASH_KEY_IS_LONG:
-                              ht = HASH_OF(*pIter);
+                             ht = HASH_OF(*pIter);
                              if (ht) {
                                  ht->nApplyCount++;
                              }
@@ -874,10 +874,9 @@ static XMLRPC_VALUE php_xmlrpc_callback(XMLRPC_SERVER server, XMLRPC_REQUEST xRe
 
    pData->php_executed = 1;
 
-	zval_dtor(xmlrpc_params);
-	FREE_ZVAL(xmlrpc_params);
+   zval_ptr_dtor(&xmlrpc_params);
 
-	return NULL;
+   return NULL;
 }
 
 /* called by the C server when it first receives an introspection request.  We pass this on to
-- 
2.50.1