Skip to content

Commit 327d4f9

Browse files
laruencelaruence
committed
Fixed bug #68361 (Segmentation fault on SoapClient::__getTypes)
1 parent 96c5c1e commit 327d4f9

File tree

3 files changed

+125
-4
lines changed

3 files changed

+125
-4
lines changed

‎NEWS

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,10 @@ PHP NEWS
1313
. Fixed bug #68129 (parse_url() - incomplete support for empty usernames
1414
and passwords) (Tjerk)
1515

16+
- CURL:
17+
. Add CURL_SSLVERSION_TLSv1_0, CURL_SSLVERSION_TLSv1_1, and
18+
CURL_SSLVERSION_TLSv1_2 constants if supported by libcurl (Rasmus)
19+
1620
- Fileinfo:
1721
. Fixed bug #66242 (libmagic: don't assume char is signed). (ArdB)
1822
. Fixed bug #68283 (fileinfo: out-of-bounds read in elf note headers).
@@ -33,13 +37,13 @@ PHP NEWS
3337
. Fixed bug #68087 (ODBC not correctly reading DATE column when preceded by
3438
a VARCHAR column) (Keyur Govande)
3539

40+
- SOAP:
41+
. Fixed bug #68361 (Segmentation fault on SoapClient::__getTypes).
42+
(Laruence)
43+
3644
- SPL:
3745
. Fixed bug #68128 (Regression in RecursiveRegexIterator) (Tjerk)
3846

39-
- CURL:
40-
. Add CURL_SSLVERSION_TLSv1_0, CURL_SSLVERSION_TLSv1_1, and
41-
CURL_SSLVERSION_TLSv1_2 constants if supported by libcurl (Rasmus)
42-
4347
16 Oct 2014, PHP 5.5.18
4448

4549
- Core:

‎ext/soap/soap.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4746,6 +4746,7 @@ static void type_to_string(sdlTypePtr type, smart_str *buf, int level)
47464746
zend_hash_find(type->attributes, SOAP_1_1_ENC_NAMESPACE":arrayType",
47474747
sizeof(SOAP_1_1_ENC_NAMESPACE":arrayType"),
47484748
(void **)&attr) == SUCCESS &&
4749+
(*attr)->extraAttributes &&
47494750
zend_hash_find((*attr)->extraAttributes, WSDL_NAMESPACE":arrayType", sizeof(WSDL_NAMESPACE":arrayType"), (void **)&ext) == SUCCESS) {
47504751
char *end = strchr((*ext)->val, '[');
47514752
int len;
@@ -4770,6 +4771,7 @@ static void type_to_string(sdlTypePtr type, smart_str *buf, int level)
47704771
zend_hash_find(type->attributes, SOAP_1_2_ENC_NAMESPACE":itemType",
47714772
sizeof(SOAP_1_2_ENC_NAMESPACE":itemType"),
47724773
(void **)&attr) == SUCCESS &&
4774+
(*attr)->extraAttributes &&
47734775
zend_hash_find((*attr)->extraAttributes, WSDL_NAMESPACE":itemType", sizeof(WSDL_NAMESPACE":arrayType"), (void **)&ext) == SUCCESS) {
47744776
smart_str_appends(buf, (*ext)->val);
47754777
smart_str_appendc(buf, ' ');
@@ -4789,6 +4791,7 @@ static void type_to_string(sdlTypePtr type, smart_str *buf, int level)
47894791
zend_hash_find(type->attributes, SOAP_1_2_ENC_NAMESPACE":arraySize",
47904792
sizeof(SOAP_1_2_ENC_NAMESPACE":arraySize"),
47914793
(void **)&attr) == SUCCESS &&
4794+
(*attr)->extraAttributes &&
47924795
zend_hash_find((*attr)->extraAttributes, WSDL_NAMESPACE":itemType", sizeof(WSDL_NAMESPACE":arraySize"), (void **)&ext) == SUCCESS) {
47934796
smart_str_appendc(buf, '[');
47944797
smart_str_appends(buf, (*ext)->val);

‎ext/soap/tests/bug68361.phpt

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
--TEST--
2+
Bug #68361 Segmentation fault on SoapClient::__getTypes
3+
--SKIPIF--
4+
<?php require_once('skipif.inc'); ?>
5+
--FILE--
6+
<?php
7+
8+
$xml = <<<XML
9+
<?xml version="1.0" encoding="UTF-8"?>
10+
<definitions name="TestServer" targetNamespace="http://foo.bar/testserver" xmlns:tns="http://foo.bar/testserver" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/" xmlns="http://schemas.xmlsoap.org/wsdl/" xmlns:ns="http://foo.bar/testserver/types">
11+
<types>
12+
<xsd:schema targetNamespace="http://foo.bar/testserver/types" xmlns="http://foo.bar/testserver/types">
13+
<xsd:complexType name="ArrayOfEmployeeReturn">
14+
<xsd:complexContent>
15+
<xsd:restriction base="soapenc:Array">
16+
<xsd:attribute ref="soapenc:arrayType" arrayType="ns:Employee[]"/>
17+
</xsd:restriction>
18+
</xsd:complexContent>
19+
</xsd:complexType>
20+
<xsd:complexType name="Employee">
21+
<xsd:sequence>
22+
<xsd:element name="id" type="xsd:int"/>
23+
<xsd:element name="department" type="xsd:string"/>
24+
<xsd:element name="name" type="xsd:string"/>
25+
<xsd:element name="age" type="xsd:int"/>
26+
</xsd:sequence>
27+
</xsd:complexType>
28+
<xsd:element name="Employee" nillable="true" type="ns:Employee"/>
29+
<xsd:complexType name="User">
30+
<xsd:sequence>
31+
<xsd:element name="name" type="xsd:string"/>
32+
<xsd:element name="age" type="xsd:int"/>
33+
</xsd:sequence>
34+
</xsd:complexType>
35+
<xsd:element name="User" nillable="true" type="ns:User"/>
36+
</xsd:schema>
37+
</types>
38+
<message name="getEmployeeRequest">
39+
<part name="name" type="xsd:name"/>
40+
</message>
41+
<message name="getEmployeeResponse">
42+
<part name="employeeReturn" type="ns:ArrayOfEmployeeReturn"/>
43+
</message>
44+
<message name="getUserRequest">
45+
<part name="id" type="xsd:id"/>
46+
</message>
47+
<message name="getUserResponse">
48+
<part name="userReturn" element="ns:User"/>
49+
</message>
50+
<portType name="TestServerPortType">
51+
<operation name="getEmployee">
52+
<input message="tns:getEmployeeRequest"/>
53+
<output message="tns:getEmployeeResponse"/>
54+
</operation>
55+
<operation name="getUser">
56+
<input message="tns:getUserRequest"/>
57+
<output message="tns:getUserResponse"/>
58+
</operation>
59+
</portType>
60+
<binding name="TestServerBinding" type="tns:TestServerPortType">
61+
<soap:binding style="rpc" transport="http://schemas.xmlsoap.org/soap/http"/>
62+
<operation name="getEmployee">
63+
<soap:operation soapAction="http://foo.bar/testserver/#getEmployee"/>
64+
<input>
65+
<soap:body use="literal" namespace="http://foo.bar/testserver"/>
66+
</input>
67+
<output>
68+
<soap:body use="literal" namespace="http://foo.bar/testserver"/>
69+
</output>
70+
</operation>
71+
<operation name="getUser">
72+
<soap:operation soapAction="http://foo.bar/testserver/#getUser"/>
73+
<input>
74+
<soap:body use="literal" namespace="http://foo.bar/testserver"/>
75+
</input>
76+
<output>
77+
<soap:body use="literal" namespace="http://foo.bar/testserver"/>
78+
</output>
79+
</operation>
80+
</binding>
81+
<service name="TestServerService">
82+
<port name="TestServerPort" binding="tns:TestServerBinding">
83+
<soap:address location="http://localhost/wsdl-creator/TestClass.php"/>
84+
</port>
85+
</service>
86+
</definitions>
87+
XML;
88+
89+
file_put_contents(__DIR__ . "/bug68361.xml", $xml);
90+
$client = new SoapClient(__DIR__ . "/bug68361.xml");
91+
92+
$res = $client->__getTypes(); // Segmentation fault here
93+
94+
print_r($res);
95+
?>
96+
--CLEAN--
97+
<?php
98+
unlink(__DIR__ . "/bug68361.xml");
99+
?>
100+
--EXPECT--
101+
Array
102+
(
103+
[0] => anyType ArrayOfEmployeeReturn[]
104+
[1] => struct Employee {
105+
int id;
106+
string department;
107+
string name;
108+
int age;
109+
}
110+
[2] => struct User {
111+
string name;
112+
int age;
113+
}
114+
)

0 commit comments

Comments
 (0)