From 327d4f9afbb81ea7bf4fd2c6c69019e886047e60 Mon Sep 17 00:00:00 2001 From: Xinchen Hui Date: Tue, 11 Nov 2014 16:22:49 +0800 Subject: [PATCH] Fixed bug #68361 (Segmentation fault on SoapClient::__getTypes) --- NEWS | 12 ++-- ext/soap/soap.c | 3 + ext/soap/tests/bug68361.phpt | 114 +++++++++++++++++++++++++++++++++++ 3 files changed, 125 insertions(+), 4 deletions(-) create mode 100644 ext/soap/tests/bug68361.phpt diff --git a/NEWS b/NEWS index 79a2b8893f..99a58662e7 100644 --- a/NEWS +++ b/NEWS @@ -13,6 +13,10 @@ PHP NEWS . Fixed bug #68129 (parse_url() - incomplete support for empty usernames and passwords) (Tjerk) +- CURL: + . Add CURL_SSLVERSION_TLSv1_0, CURL_SSLVERSION_TLSv1_1, and + CURL_SSLVERSION_TLSv1_2 constants if supported by libcurl (Rasmus) + - Fileinfo: . Fixed bug #66242 (libmagic: don't assume char is signed). (ArdB) . Fixed bug #68283 (fileinfo: out-of-bounds read in elf note headers). @@ -33,13 +37,13 @@ PHP NEWS . Fixed bug #68087 (ODBC not correctly reading DATE column when preceded by a VARCHAR column) (Keyur Govande) +- SOAP: + . Fixed bug #68361 (Segmentation fault on SoapClient::__getTypes). + (Laruence) + - SPL: . Fixed bug #68128 (Regression in RecursiveRegexIterator) (Tjerk) -- CURL: - . Add CURL_SSLVERSION_TLSv1_0, CURL_SSLVERSION_TLSv1_1, and - CURL_SSLVERSION_TLSv1_2 constants if supported by libcurl (Rasmus) - 16 Oct 2014, PHP 5.5.18 - Core: diff --git a/ext/soap/soap.c b/ext/soap/soap.c index cca8c912e9..80a3a93cec 100644 --- a/ext/soap/soap.c +++ b/ext/soap/soap.c @@ -4746,6 +4746,7 @@ static void type_to_string(sdlTypePtr type, smart_str *buf, int level) zend_hash_find(type->attributes, SOAP_1_1_ENC_NAMESPACE":arrayType", sizeof(SOAP_1_1_ENC_NAMESPACE":arrayType"), (void **)&attr) == SUCCESS && + (*attr)->extraAttributes && zend_hash_find((*attr)->extraAttributes, WSDL_NAMESPACE":arrayType", sizeof(WSDL_NAMESPACE":arrayType"), (void **)&ext) == SUCCESS) { char *end = strchr((*ext)->val, '['); int len; @@ -4770,6 +4771,7 @@ static void type_to_string(sdlTypePtr type, smart_str *buf, int level) zend_hash_find(type->attributes, SOAP_1_2_ENC_NAMESPACE":itemType", sizeof(SOAP_1_2_ENC_NAMESPACE":itemType"), (void **)&attr) == SUCCESS && + (*attr)->extraAttributes && zend_hash_find((*attr)->extraAttributes, WSDL_NAMESPACE":itemType", sizeof(WSDL_NAMESPACE":arrayType"), (void **)&ext) == SUCCESS) { smart_str_appends(buf, (*ext)->val); smart_str_appendc(buf, ' '); @@ -4789,6 +4791,7 @@ static void type_to_string(sdlTypePtr type, smart_str *buf, int level) zend_hash_find(type->attributes, SOAP_1_2_ENC_NAMESPACE":arraySize", sizeof(SOAP_1_2_ENC_NAMESPACE":arraySize"), (void **)&attr) == SUCCESS && + (*attr)->extraAttributes && zend_hash_find((*attr)->extraAttributes, WSDL_NAMESPACE":itemType", sizeof(WSDL_NAMESPACE":arraySize"), (void **)&ext) == SUCCESS) { smart_str_appendc(buf, '['); smart_str_appends(buf, (*ext)->val); diff --git a/ext/soap/tests/bug68361.phpt b/ext/soap/tests/bug68361.phpt new file mode 100644 index 0000000000..6dbba8a425 --- /dev/null +++ b/ext/soap/tests/bug68361.phpt @@ -0,0 +1,114 @@ +--TEST-- +Bug #68361 Segmentation fault on SoapClient::__getTypes +--SKIPIF-- + +--FILE-- + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +XML; + +file_put_contents(__DIR__ . "/bug68361.xml", $xml); +$client = new SoapClient(__DIR__ . "/bug68361.xml"); + +$res = $client->__getTypes(); // Segmentation fault here + +print_r($res); +?> +--CLEAN-- + +--EXPECT-- +Array +( + [0] => anyType ArrayOfEmployeeReturn[] + [1] => struct Employee { + int id; + string department; + string name; + int age; +} + [2] => struct User { + string name; + int age; +} +) -- 2.40.0