Skip to content

Commit 37db2ed

Browse files
committed
Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3: Fix GH-16429: Segmentation fault (access null pointer) in SoapClient
2 parents 7a7ab73 + 0b657fe commit 37db2ed

File tree

3 files changed

+27
-2
lines changed

3 files changed

+27
-2
lines changed

NEWS

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,8 @@ PHP NEWS
6666

6767
- SOAP:
6868
. Fixed bug GH-16318 (Recursive array segfaults soap encoding). (nielsdos)
69+
. Fixed bug GH-16429 (Segmentation fault access null pointer in SoapClient).
70+
(nielsdos)
6971

7072
- Sockets:
7173
. Fixed bug with overflow socket_recvfrom $length argument. (David Carlier)

ext/soap/php_encoding.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2268,8 +2268,8 @@ static xmlNodePtr to_xml_array(encodeTypePtr type, zval *data, int style, xmlNod
22682268

22692269
iter = ce->get_iterator(ce, data, 0);
22702270

2271-
if (EG(exception)) {
2272-
goto iterator_done;
2271+
if (!iter) {
2272+
goto iterator_failed_to_get;
22732273
}
22742274

22752275
if (iter->funcs->rewind) {
@@ -2309,6 +2309,7 @@ static xmlNodePtr to_xml_array(encodeTypePtr type, zval *data, int style, xmlNod
23092309
}
23102310
iterator_done:
23112311
OBJ_RELEASE(&iter->std);
2312+
iterator_failed_to_get:
23122313
if (EG(exception)) {
23132314
zval_ptr_dtor(&array_copy);
23142315
ZVAL_UNDEF(&array_copy);

ext/soap/tests/bugs/gh16429.phpt

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
--TEST--
2+
GH-16429 (Segmentation fault (access null pointer) in SoapClient)
3+
--EXTENSIONS--
4+
soap
5+
--FILE--
6+
<?php
7+
function gen() {
8+
var_dump(str_repeat("x", yield));
9+
}
10+
$gen = gen();
11+
$gen->send(10);
12+
$fusion = $gen;
13+
$client = new SoapClient(__DIR__."/../interop/Round2/GroupB/round2_groupB.wsdl",array("trace"=>1,"exceptions"=>0));
14+
try {
15+
$client->echo2DStringArray($fusion);
16+
} catch (Exception $e) {
17+
echo $e->getMessage(), "\n";
18+
}
19+
?>
20+
--EXPECT--
21+
string(10) "xxxxxxxxxx"
22+
Cannot traverse an already closed generator

0 commit comments

Comments
 (0)