diff --git a/NEWS b/NEWS index 587a07ef54b..476b7e14caa 100644 --- a/NEWS +++ b/NEWS @@ -97,6 +97,8 @@ PHP NEWS - SOAP: . Fixed bug GH-16237 (Segmentation fault when cloning SoapServer). (nielsdos) . Fix Soap leaking http_msg on error. (nielsdos) + . Fixed bug GH-16256 (Assertion failure in ext/soap/php_encoding.c:460). + (nielsdos) - Standard: . Fixed bug GH-16053 (Assertion failure in Zend/zend_hash.c). (Arnaud) diff --git a/ext/soap/soap.c b/ext/soap/soap.c index 5e667ef14c6..6a718f3af14 100644 --- a/ext/soap/soap.c +++ b/ext/soap/soap.c @@ -955,6 +955,9 @@ PHP_METHOD(SoapServer, __construct) if ((tmp = zend_hash_str_find(ht, "classmap", sizeof("classmap")-1)) != NULL && Z_TYPE_P(tmp) == IS_ARRAY) { + if (HT_IS_PACKED(Z_ARRVAL_P(tmp))) { + php_error_docref(NULL, E_ERROR, "'classmap' option must be an associative array"); + } service->class_map = zend_array_dup(Z_ARRVAL_P(tmp)); } @@ -2114,6 +2117,9 @@ PHP_METHOD(SoapClient, __construct) } if ((tmp = zend_hash_str_find(ht, "classmap", sizeof("classmap")-1)) != NULL && Z_TYPE_P(tmp) == IS_ARRAY) { + if (HT_IS_PACKED(Z_ARRVAL_P(tmp))) { + php_error_docref(NULL, E_ERROR, "'classmap' option must be an associative array"); + } ZVAL_COPY(Z_CLIENT_CLASSMAP_P(this_ptr), tmp); } diff --git a/ext/soap/tests/bugs/gh16256.phpt b/ext/soap/tests/bugs/gh16256.phpt new file mode 100644 index 00000000000..ca8c00af5bb --- /dev/null +++ b/ext/soap/tests/bugs/gh16256.phpt @@ -0,0 +1,25 @@ +--TEST-- +GH-16256 (Assertion failure in ext/soap/php_encoding.c:460) +--EXTENSIONS-- +soap +--FILE-- + $classmap]); +} catch (Throwable $e) { + echo $e->getMessage(), "\n"; +} +try { + new SoapServer($wsdl, ["classmap" => $classmap]); +} catch (Throwable $e) { + echo $e->getMessage(), "\n"; +} +?> +--EXPECT-- +SoapClient::__construct(): 'classmap' option must be an associative array + +SOAP-ENV:ServerSoapServer::__construct(): 'classmap' option must be an associative array