diff --git a/NEWS b/NEWS index 5a53f3a70e7..c85770b8bb7 100644 --- a/NEWS +++ b/NEWS @@ -81,6 +81,8 @@ PHP NEWS (nielsdos) . Fixed bug GH-16237 (Segmentation fault when cloning SoapServer). (nielsdos) . Fix Soap leaking http_msg on error. (nielsdos) + . Fixed bug GH-16256 (Assertion failure in ext/soap/php_encoding.c:460). + (nielsdos) - SPL: . Fixed bug GH-15918 (Assertion failure in ext/spl/spl_fixedarray.c). diff --git a/ext/soap/soap.c b/ext/soap/soap.c index 1459a2361c9..3f8a50ba6ed 100644 --- a/ext/soap/soap.c +++ b/ext/soap/soap.c @@ -838,6 +838,9 @@ PHP_METHOD(SoapServer, __construct) if ((tmp = zend_hash_str_find(ht, "classmap", sizeof("classmap")-1)) != NULL && Z_TYPE_P(tmp) == IS_ARRAY) { + if (HT_IS_PACKED(Z_ARRVAL_P(tmp))) { + php_error_docref(NULL, E_ERROR, "'classmap' option must be an associative array"); + } service->class_map = zend_array_dup(Z_ARRVAL_P(tmp)); } @@ -2004,6 +2007,9 @@ PHP_METHOD(SoapClient, __construct) } if ((tmp = zend_hash_str_find(ht, "classmap", sizeof("classmap")-1)) != NULL && Z_TYPE_P(tmp) == IS_ARRAY) { + if (HT_IS_PACKED(Z_ARRVAL_P(tmp))) { + php_error_docref(NULL, E_ERROR, "'classmap' option must be an associative array"); + } ZVAL_COPY(Z_CLIENT_CLASSMAP_P(this_ptr), tmp); } diff --git a/ext/soap/tests/bugs/gh16256.phpt b/ext/soap/tests/bugs/gh16256.phpt new file mode 100644 index 00000000000..ca8c00af5bb --- /dev/null +++ b/ext/soap/tests/bugs/gh16256.phpt @@ -0,0 +1,25 @@ +--TEST-- +GH-16256 (Assertion failure in ext/soap/php_encoding.c:460) +--EXTENSIONS-- +soap +--FILE-- + $classmap]); +} catch (Throwable $e) { + echo $e->getMessage(), "\n"; +} +try { + new SoapServer($wsdl, ["classmap" => $classmap]); +} catch (Throwable $e) { + echo $e->getMessage(), "\n"; +} +?> +--EXPECT-- +SoapClient::__construct(): 'classmap' option must be an associative array + +SOAP-ENV:ServerSoapServer::__construct(): 'classmap' option must be an associative array