Skip to content

Commit 0b657fe

Browse files
committed
Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2: Fix GH-16429: Segmentation fault (access null pointer) in SoapClient
2 parents c924af0 + d613c0e commit 0b657fe

File tree

3 files changed

+27
-2
lines changed

3 files changed

+27
-2
lines changed

NEWS

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,8 @@ PHP NEWS
6262

6363
- SOAP:
6464
. Fixed bug GH-16318 (Recursive array segfaults soap encoding). (nielsdos)
65+
. Fixed bug GH-16429 (Segmentation fault access null pointer in SoapClient).
66+
(nielsdos)
6567

6668
- Sockets:
6769
. Fixed bug with overflow socket_recvfrom $length argument. (David Carlier)

ext/soap/php_encoding.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2255,8 +2255,8 @@ static xmlNodePtr to_xml_array(encodeTypePtr type, zval *data, int style, xmlNod
22552255

22562256
iter = ce->get_iterator(ce, data, 0);
22572257

2258-
if (EG(exception)) {
2259-
goto iterator_done;
2258+
if (!iter) {
2259+
goto iterator_failed_to_get;
22602260
}
22612261

22622262
if (iter->funcs->rewind) {
@@ -2296,6 +2296,7 @@ static xmlNodePtr to_xml_array(encodeTypePtr type, zval *data, int style, xmlNod
22962296
}
22972297
iterator_done:
22982298
OBJ_RELEASE(&iter->std);
2299+
iterator_failed_to_get:
22992300
if (EG(exception)) {
23002301
zval_ptr_dtor(&array_copy);
23012302
ZVAL_UNDEF(&array_copy);

ext/soap/tests/bugs/gh16429.phpt

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
--TEST--
2+
GH-16429 (Segmentation fault (access null pointer) in SoapClient)
3+
--EXTENSIONS--
4+
soap
5+
--FILE--
6+
<?php
7+
function gen() {
8+
var_dump(str_repeat("x", yield));
9+
}
10+
$gen = gen();
11+
$gen->send(10);
12+
$fusion = $gen;
13+
$client = new SoapClient(__DIR__."/../interop/Round2/GroupB/round2_groupB.wsdl",array("trace"=>1,"exceptions"=>0));
14+
try {
15+
$client->echo2DStringArray($fusion);
16+
} catch (Exception $e) {
17+
echo $e->getMessage(), "\n";
18+
}
19+
?>
20+
--EXPECT--
21+
string(10) "xxxxxxxxxx"
22+
Cannot traverse an already closed generator

0 commit comments

Comments
 (0)