mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-12-18 06:21:41 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fixed bug #68361 (Segmentation fault on SoapClient::__getTypes)

Browse Source
This commit is contained in:
Xinchen Hui 2014-11-11 16:22:49 +08:00
parent 96c5c1ef59
commit 327d4f9afb
3 changed files with 125 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
NEWS
View File

@ -13,6 +13,10 @@ PHP NEWS
. Fixed bug #68129 (parse_url() - incomplete support for empty usernames
and passwords) (Tjerk)
- CURL:
. Add CURL_SSLVERSION_TLSv1_0, CURL_SSLVERSION_TLSv1_1, and
CURL_SSLVERSION_TLSv1_2 constants if supported by libcurl (Rasmus)
- Fileinfo:
. Fixed bug #66242 (libmagic: don't assume char is signed). (ArdB)
. Fixed bug #68283 (fileinfo: out-of-bounds read in elf note headers).
@ -33,13 +37,13 @@ PHP NEWS
. Fixed bug #68087 (ODBC not correctly reading DATE column when preceded by
a VARCHAR column) (Keyur Govande)
- SOAP:
. Fixed bug #68361 (Segmentation fault on SoapClient::__getTypes).
(Laruence)
- SPL:
. Fixed bug #68128 (Regression in RecursiveRegexIterator) (Tjerk)
- CURL:
. Add CURL_SSLVERSION_TLSv1_0, CURL_SSLVERSION_TLSv1_1, and
CURL_SSLVERSION_TLSv1_2 constants if supported by libcurl (Rasmus)
16 Oct 2014, PHP 5.5.18
- Core:

3
ext/soap/soap.c
View File

@ -4746,6 +4746,7 @@ static void type_to_string(sdlTypePtr type, smart_str *buf, int level)
zend_hash_find(type->attributes, SOAP_1_1_ENC_NAMESPACE":arrayType",
sizeof(SOAP_1_1_ENC_NAMESPACE":arrayType"),
(void **)&attr) == SUCCESS &&
(*attr)->extraAttributes &&
zend_hash_find((*attr)->extraAttributes, WSDL_NAMESPACE":arrayType", sizeof(WSDL_NAMESPACE":arrayType"), (void **)&ext) == SUCCESS) {
char *end = strchr((*ext)->val, '[');
int len;
@ -4770,6 +4771,7 @@ static void type_to_string(sdlTypePtr type, smart_str *buf, int level)
zend_hash_find(type->attributes, SOAP_1_2_ENC_NAMESPACE":itemType",
sizeof(SOAP_1_2_ENC_NAMESPACE":itemType"),
(void **)&attr) == SUCCESS &&
(*attr)->extraAttributes &&
zend_hash_find((*attr)->extraAttributes, WSDL_NAMESPACE":itemType", sizeof(WSDL_NAMESPACE":arrayType"), (void **)&ext) == SUCCESS) {
smart_str_appends(buf, (*ext)->val);
smart_str_appendc(buf, ' ');
@ -4789,6 +4791,7 @@ static void type_to_string(sdlTypePtr type, smart_str *buf, int level)
zend_hash_find(type->attributes, SOAP_1_2_ENC_NAMESPACE":arraySize",
sizeof(SOAP_1_2_ENC_NAMESPACE":arraySize"),
(void **)&attr) == SUCCESS &&
(*attr)->extraAttributes &&
zend_hash_find((*attr)->extraAttributes, WSDL_NAMESPACE":itemType", sizeof(WSDL_NAMESPACE":arraySize"), (void **)&ext) == SUCCESS) {
smart_str_appendc(buf, '[');
smart_str_appends(buf, (*ext)->val);

114
ext/soap/tests/bug68361.phpt Normal file
View File

@ -0,0 +1,114 @@
--TEST--
Bug #68361 Segmentation fault on SoapClient::__getTypes
--SKIPIF--
<?php require_once('skipif.inc'); ?>
--FILE--
<?php
$xml = <<<XML
<?xml version="1.0" encoding="UTF-8"?>
<definitions name="TestServer" targetNamespace="http://foo.bar/testserver" xmlns:tns="http://foo.bar/testserver" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/" xmlns="http://schemas.xmlsoap.org/wsdl/" xmlns:ns="http://foo.bar/testserver/types">
<types>
<xsd:schema targetNamespace="http://foo.bar/testserver/types" xmlns="http://foo.bar/testserver/types">
<xsd:complexType name="ArrayOfEmployeeReturn">
<xsd:complexContent>
<xsd:restriction base="soapenc:Array">
<xsd:attribute ref="soapenc:arrayType" arrayType="ns:Employee[]"/>
</xsd:restriction>
</xsd:complexContent>
</xsd:complexType>
<xsd:complexType name="Employee">
<xsd:sequence>
<xsd:element name="id" type="xsd:int"/>
<xsd:element name="department" type="xsd:string"/>
<xsd:element name="name" type="xsd:string"/>
<xsd:element name="age" type="xsd:int"/>
</xsd:sequence>
</xsd:complexType>
<xsd:element name="Employee" nillable="true" type="ns:Employee"/>
<xsd:complexType name="User">
<xsd:sequence>
<xsd:element name="name" type="xsd:string"/>
<xsd:element name="age" type="xsd:int"/>
</xsd:sequence>
</xsd:complexType>
<xsd:element name="User" nillable="true" type="ns:User"/>
</xsd:schema>
</types>
<message name="getEmployeeRequest">
<part name="name" type="xsd:name"/>
</message>
<message name="getEmployeeResponse">
<part name="employeeReturn" type="ns:ArrayOfEmployeeReturn"/>
</message>
<message name="getUserRequest">
<part name="id" type="xsd:id"/>
</message>
<message name="getUserResponse">
<part name="userReturn" element="ns:User"/>
</message>
<portType name="TestServerPortType">
<operation name="getEmployee">
<input message="tns:getEmployeeRequest"/>
<output message="tns:getEmployeeResponse"/>
</operation>
<operation name="getUser">
<input message="tns:getUserRequest"/>
<output message="tns:getUserResponse"/>
</operation>
</portType>
<binding name="TestServerBinding" type="tns:TestServerPortType">
<soap:binding style="rpc" transport="http://schemas.xmlsoap.org/soap/http"/>
<operation name="getEmployee">
<soap:operation soapAction="http://foo.bar/testserver/#getEmployee"/>
<input>
<soap:body use="literal" namespace="http://foo.bar/testserver"/>
</input>
<output>
<soap:body use="literal" namespace="http://foo.bar/testserver"/>
</output>
</operation>
<operation name="getUser">
<soap:operation soapAction="http://foo.bar/testserver/#getUser"/>
<input>
<soap:body use="literal" namespace="http://foo.bar/testserver"/>
</input>
<output>
<soap:body use="literal" namespace="http://foo.bar/testserver"/>
</output>
</operation>
</binding>
<service name="TestServerService">
<port name="TestServerPort" binding="tns:TestServerBinding">
<soap:address location="http://localhost/wsdl-creator/TestClass.php"/>
</port>
</service>
</definitions>
XML;
file_put_contents(__DIR__ . "/bug68361.xml", $xml);
$client = new SoapClient(__DIR__ . "/bug68361.xml");
$res = $client->__getTypes(); // Segmentation fault here
print_r($res);
?>
--CLEAN--
<?php
unlink(__DIR__ . "/bug68361.xml");
?>
--EXPECT--
Array
(
[0] => anyType ArrayOfEmployeeReturn[]
[1] => struct Employee {
int id;
string department;
string name;
int age;
}
[2] => struct User {
string name;
int age;
}
)