Fixed bug #68361 (Segmentation fault on SoapClient::__getTypes)

3 files changed, 125 insertions, 4 deletions

diff --git a/NEWS b/NEWS
index 79a2b8893f..99a58662e7 100644
--- a/NEWS
+++ b/NEWS
@@ -13,6 +13,10 @@ PHP                                                                        NEWS
   . Fixed bug #68129 (parse_url() - incomplete support for empty usernames
     and passwords) (Tjerk)
 
+- CURL:
+  . Add CURL_SSLVERSION_TLSv1_0, CURL_SSLVERSION_TLSv1_1, and 
+    CURL_SSLVERSION_TLSv1_2 constants if supported by libcurl (Rasmus)
+
 - Fileinfo:
   . Fixed bug #66242 (libmagic: don't assume char is signed). (ArdB)
   . Fixed bug #68283 (fileinfo: out-of-bounds read in elf note headers).
@@ -33,13 +37,13 @@ PHP                                                                        NEWS
   . Fixed bug #68087 (ODBC not correctly reading DATE column when preceded by
     a VARCHAR column) (Keyur Govande)
 
+- SOAP:
+  . Fixed bug #68361 (Segmentation fault on SoapClient::__getTypes).
+    (Laruence)
+
 - SPL:
   . Fixed bug #68128 (Regression in RecursiveRegexIterator) (Tjerk)
 
-- CURL:
-  . Add CURL_SSLVERSION_TLSv1_0, CURL_SSLVERSION_TLSv1_1, and 
-    CURL_SSLVERSION_TLSv1_2 constants if supported by libcurl (Rasmus)
-
 16 Oct 2014, PHP 5.5.18
 
 - Core:
diff --git a/ext/soap/soap.c b/ext/soap/soap.c
index cca8c912e9..80a3a93cec 100644
--- a/ext/soap/soap.c
+++ b/ext/soap/soap.c
@@ -4746,6 +4746,7 @@ static void type_to_string(sdlTypePtr type, smart_str *buf, int level)
 				    zend_hash_find(type->attributes, SOAP_1_1_ENC_NAMESPACE":arrayType",
 				      sizeof(SOAP_1_1_ENC_NAMESPACE":arrayType"),
 				      (void **)&attr) == SUCCESS &&
+				      (*attr)->extraAttributes &&
 				      zend_hash_find((*attr)->extraAttributes, WSDL_NAMESPACE":arrayType", sizeof(WSDL_NAMESPACE":arrayType"), (void **)&ext) == SUCCESS) {
 					char *end = strchr((*ext)->val, '[');
 					int len;
@@ -4770,6 +4771,7 @@ static void type_to_string(sdlTypePtr type, smart_str *buf, int level)
 					    zend_hash_find(type->attributes, SOAP_1_2_ENC_NAMESPACE":itemType",
 					      sizeof(SOAP_1_2_ENC_NAMESPACE":itemType"),
 					      (void **)&attr) == SUCCESS &&
+					      (*attr)->extraAttributes &&
 					      zend_hash_find((*attr)->extraAttributes, WSDL_NAMESPACE":itemType", sizeof(WSDL_NAMESPACE":arrayType"), (void **)&ext) == SUCCESS) {
 						smart_str_appends(buf, (*ext)->val);
 						smart_str_appendc(buf, ' ');
@@ -4789,6 +4791,7 @@ static void type_to_string(sdlTypePtr type, smart_str *buf, int level)
 					    zend_hash_find(type->attributes, SOAP_1_2_ENC_NAMESPACE":arraySize",
 					      sizeof(SOAP_1_2_ENC_NAMESPACE":arraySize"),
 					      (void **)&attr) == SUCCESS &&
+					      (*attr)->extraAttributes &&
 					      zend_hash_find((*attr)->extraAttributes, WSDL_NAMESPACE":itemType", sizeof(WSDL_NAMESPACE":arraySize"), (void **)&ext) == SUCCESS) {
 						smart_str_appendc(buf, '[');
 						smart_str_appends(buf, (*ext)->val);
diff --git a/ext/soap/tests/bug68361.phpt b/ext/soap/tests/bug68361.phpt
new file mode 100644
index 0000000000..6dbba8a425
--- /dev/null
+++ b/ext/soap/tests/bug68361.phpt
@@ -0,0 +1,114 @@
+--TEST--
+Bug #68361 Segmentation fault on SoapClient::__getTypes
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+
+$xml = <<<XML
+<?xml version="1.0" encoding="UTF-8"?>
+<definitions name="TestServer" targetNamespace="http://foo.bar/testserver" xmlns:tns="http://foo.bar/testserver" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/" xmlns="http://schemas.xmlsoap.org/wsdl/" xmlns:ns="http://foo.bar/testserver/types">
+  <types>
+    <xsd:schema targetNamespace="http://foo.bar/testserver/types" xmlns="http://foo.bar/testserver/types">
+      <xsd:complexType name="ArrayOfEmployeeReturn">
+        <xsd:complexContent>
+          <xsd:restriction base="soapenc:Array">
+            <xsd:attribute ref="soapenc:arrayType" arrayType="ns:Employee[]"/>
+          </xsd:restriction>
+        </xsd:complexContent>
+      </xsd:complexType>
+      <xsd:complexType name="Employee">
+        <xsd:sequence>
+          <xsd:element name="id" type="xsd:int"/>
+          <xsd:element name="department" type="xsd:string"/>
+          <xsd:element name="name" type="xsd:string"/>
+          <xsd:element name="age" type="xsd:int"/>
+        </xsd:sequence>
+      </xsd:complexType>
+      <xsd:element name="Employee" nillable="true" type="ns:Employee"/>
+      <xsd:complexType name="User">
+        <xsd:sequence>
+          <xsd:element name="name" type="xsd:string"/>
+          <xsd:element name="age" type="xsd:int"/>
+        </xsd:sequence>
+      </xsd:complexType>
+      <xsd:element name="User" nillable="true" type="ns:User"/>
+    </xsd:schema>
+  </types>
+  <message name="getEmployeeRequest">
+    <part name="name" type="xsd:name"/>
+  </message>
+  <message name="getEmployeeResponse">
+    <part name="employeeReturn" type="ns:ArrayOfEmployeeReturn"/>
+  </message>
+  <message name="getUserRequest">
+    <part name="id" type="xsd:id"/>
+  </message>
+  <message name="getUserResponse">
+    <part name="userReturn" element="ns:User"/>
+  </message>
+  <portType name="TestServerPortType">
+    <operation name="getEmployee">
+      <input message="tns:getEmployeeRequest"/>
+      <output message="tns:getEmployeeResponse"/>
+    </operation>
+    <operation name="getUser">
+      <input message="tns:getUserRequest"/>
+      <output message="tns:getUserResponse"/>
+    </operation>
+  </portType>
+  <binding name="TestServerBinding" type="tns:TestServerPortType">
+    <soap:binding style="rpc" transport="http://schemas.xmlsoap.org/soap/http"/>
+    <operation name="getEmployee">
+      <soap:operation soapAction="http://foo.bar/testserver/#getEmployee"/>
+      <input>
+        <soap:body use="literal" namespace="http://foo.bar/testserver"/>
+      </input>
+      <output>
+        <soap:body use="literal" namespace="http://foo.bar/testserver"/>
+      </output>
+    </operation>
+    <operation name="getUser">
+      <soap:operation soapAction="http://foo.bar/testserver/#getUser"/>
+      <input>
+        <soap:body use="literal" namespace="http://foo.bar/testserver"/>
+      </input>
+      <output>
+        <soap:body use="literal" namespace="http://foo.bar/testserver"/>
+      </output>
+    </operation>
+  </binding>
+  <service name="TestServerService">
+    <port name="TestServerPort" binding="tns:TestServerBinding">
+      <soap:address location="http://localhost/wsdl-creator/TestClass.php"/>
+    </port>
+  </service>
+</definitions>
+XML;
+
+file_put_contents(__DIR__ . "/bug68361.xml", $xml);
+$client = new SoapClient(__DIR__ . "/bug68361.xml");
+
+$res = $client->__getTypes(); // Segmentation fault here
+
+print_r($res);
+?>
+--CLEAN--
+<?php
+unlink(__DIR__ . "/bug68361.xml");
+?>
+--EXPECT--
+Array
+(
+    [0] => anyType ArrayOfEmployeeReturn[]
+    [1] => struct Employee {
+ int id;
+ string department;
+ string name;
+ int age;
+}
+    [2] => struct User {
+ string name;
+ int age;
+}
+)