php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.3' into PHP-8.4

Browse Source 
* PHP-8.3:
  Fix GH-16429: Segmentation fault (access null pointer) in SoapClient
This commit is contained in:
Niels Dossche
2024-10-14 22:00:45 +02:00
parent 7a7ab73d3b 0b657fea2b
commit 37db2edd26
3 changed files with 27 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
NEWS
View File

@@ -66,6 +66,8 @@ PHP NEWS
- SOAP: - SOAP:
. Fixed bug GH-16318 (Recursive array segfaults soap encoding). (nielsdos) . Fixed bug GH-16318 (Recursive array segfaults soap encoding). (nielsdos)
. Fixed bug GH-16429 (Segmentation fault access null pointer in SoapClient).
(nielsdos)
- Sockets: - Sockets:
. Fixed bug with overflow socket_recvfrom $length argument. (David Carlier) . Fixed bug with overflow socket_recvfrom $length argument. (David Carlier)

5
ext/soap/php_encoding.c
View File

@@ -2268,8 +2268,8 @@ static xmlNodePtr to_xml_array(encodeTypePtr type, zval *data, int style, xmlNod
iter = ce->get_iterator(ce, data, 0); iter = ce->get_iterator(ce, data, 0);
if (EG(exception)) { if (!iter) {
goto iterator_done; goto iterator_failed_to_get;
} }
if (iter->funcs->rewind) { if (iter->funcs->rewind) {
@@ -2309,6 +2309,7 @@ static xmlNodePtr to_xml_array(encodeTypePtr type, zval *data, int style, xmlNod
} }
iterator_done: iterator_done:
OBJ_RELEASE(&iter->std); OBJ_RELEASE(&iter->std);
iterator_failed_to_get:
if (EG(exception)) { if (EG(exception)) {
zval_ptr_dtor(&array_copy); zval_ptr_dtor(&array_copy);
ZVAL_UNDEF(&array_copy); ZVAL_UNDEF(&array_copy);

22
ext/soap/tests/bugs/gh16429.phpt Normal file
View File

@@ -0,0 +1,22 @@
--TEST--
GH-16429 (Segmentation fault (access null pointer) in SoapClient)
--EXTENSIONS--
soap
--FILE--
<?php
function gen() {
var_dump(str_repeat("x", yield));
}
$gen = gen();
$gen->send(10);
$fusion = $gen;
$client = new SoapClient(__DIR__."/../interop/Round2/GroupB/round2_groupB.wsdl",array("trace"=>1,"exceptions"=>0));
try {
$client->echo2DStringArray($fusion);
} catch (Exception $e) {
echo $e->getMessage(), "\n";
}
?>
--EXPECT--
string(10) "xxxxxxxxxx"
Cannot traverse an already closed generator