Fixed bug #42326 (SoapServer crash)

4 files changed, 140 insertions, 3 deletions

diff --git a/NEWS b/NEWS
index 684a9b7098..0546cc0f33 100644
--- a/NEWS
+++ b/NEWS
@@ -7,6 +7,7 @@ PHP                                                                        NEWS
   DOMElement). (Rob)
 - Fixed bug #42452 (PDO classes do not expose Reflection API information).
   (Hannes)
+- Fixed bug #42326 (SoapServer crash). (Dmitry)
 
 30 Aug 2007, PHP 5.2.4
 - Removed --enable-versioning configure option. (Jani)
diff --git a/ext/soap/php_encoding.c b/ext/soap/php_encoding.c
index 197d07b0c2..65e703d5d2 100644
--- a/ext/soap/php_encoding.c
+++ b/ext/soap/php_encoding.c
@@ -357,7 +357,7 @@ static zend_bool soap_check_xml_ref(zval **data, xmlNodePtr node TSRMLS_DC)
 	return 0;
 }
 
-xmlNodePtr master_to_xml(encodePtr encode, zval *data, int style, xmlNodePtr parent)
+static xmlNodePtr master_to_xml_int(encodePtr encode, zval *data, int style, xmlNodePtr parent, int check_class_map)
 {
 	xmlNodePtr node = NULL;
 	TSRMLS_FETCH();
@@ -428,7 +428,7 @@ xmlNodePtr master_to_xml(encodePtr encode, zval *data, int style, xmlNodePtr par
 			xmlSetNs(node, nsp);
 		}
 	} else {
-		if (SOAP_GLOBAL(class_map) && data &&
+		if (check_class_map && SOAP_GLOBAL(class_map) && data &&
 		    Z_TYPE_P(data) == IS_OBJECT &&
 		    !Z_OBJPROP_P(data)->nApplyCount) {
 			zend_class_entry *ce = Z_OBJCE_P(data);
@@ -489,6 +489,11 @@ xmlNodePtr master_to_xml(encodePtr encode, zval *data, int style, xmlNodePtr par
 	return node;
 }
 
+xmlNodePtr master_to_xml(encodePtr encode, zval *data, int style, xmlNodePtr parent)
+{
+	return master_to_xml_int(encode, data, style, parent, 1);
+}
+
 static zval *master_to_zval_int(encodePtr encode, xmlNodePtr data)
 {
 	zval *ret = NULL;
@@ -2685,7 +2690,7 @@ static xmlNodePtr guess_xml_convert(encodeTypePtr type, zval *data, int style, x
 	} else {
 		enc = get_conversion(IS_NULL);
 	}
-	ret = master_to_xml(enc, data, style, parent);
+	ret = master_to_xml_int(enc, data, style, parent, 0);
 /*
 	if (style == SOAP_LITERAL && SOAP_GLOBAL(sdl)) {
 		set_ns_and_type(ret, &enc->details);
diff --git a/ext/soap/tests/bugs/bug42326.phpt b/ext/soap/tests/bugs/bug42326.phpt
new file mode 100755
index 0000000000..2e6c7c3501
--- /dev/null
+++ b/ext/soap/tests/bugs/bug42326.phpt
@@ -0,0 +1,49 @@
+--TEST--
+Bug #42326 (SoapServer crash)
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--INI--
+soap.wsdl_cache_enabled=0
+--FILE--
+<?php
+$request = <<<EOF
+<?xml version="1.0" encoding="UTF-8"?>
+<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="http://www.example.com/"><SOAP-ENV:Body><ns1:GetProductsRequest><time></time></ns1:GetProductsRequest></SOAP-ENV:Body></SOAP-ENV:Envelope>
+EOF;
+
+
+$soap_admin_classmap = array('productDetailsType' => 'SOAP_productDetailsType',
+                             'GetProductsRequest' => 'SOAP_GetProductsRequest',
+                             'GetProductsResponse' => 'SOAP_GetProductsResponse');
+
+class SOAP_productDetailsType {
+    public $id = 0;
+}
+
+class SOAP_GetProductsRequest {
+    public $time = '';
+}
+
+class SOAP_GetProductsResponse {
+    public $products;
+    function __construct(){
+        $this->products = new SOAP_productDetailsType();
+        
+    }
+}
+
+class SOAP_Admin {
+    public function GetProducts($time){
+        return new SOAP_GetProductsResponse();
+    }
+}
+
+$soap = new SoapServer(dirname(__FILE__).'/bug42326.wsdl', array('classmap' => $soap_admin_classmap));
+$soap->setClass('SOAP_Admin');
+ob_start();
+$soap->handle($request);
+ob_end_clean();
+echo "ok\n";
+?>
+--EXPECT--
+ok
diff --git a/ext/soap/tests/bugs/bug42326.wsdl b/ext/soap/tests/bugs/bug42326.wsdl
new file mode 100755
index 0000000000..a125ed8cd8
--- /dev/null
+++ b/ext/soap/tests/bugs/bug42326.wsdl
@@ -0,0 +1,82 @@
+<?xml version="1.0"?>

+<wsdl:definitions name="OSCAdmin.wsdl"

+targetNamespace="http://www.example.com/"

+xmlns:tns="http://www.example.com/"

+xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/"

+xmlns:xsd="http://www.w3.org/2001/XMLSchema"

+xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/">          

+    <wsdl:types>

+

+       <xsd:schema targetNamespace="http://www.example.com/"

+              xmlns="http://www.w3.org/2000/10/XMLSchema">

+              <xsd:element name="productDetailsType">

+              <xsd:complexType>

+              <xsd:all>

+              <xsd:element name="id" type="xsd:integer"/>

+              

+              </xsd:all>

+              </xsd:complexType>

+              </xsd:element>

+       </xsd:schema>

+

+

+       <xsd:schema targetNamespace="http://www.example.com/"

+              xmlns="http://www.w3.org/2000/10/XMLSchema">

+              <xsd:element name="GetProductsRequest">

+              <xsd:complexType>

+              <xsd:all>

+              <xsd:element name="time" type="xsd:string"/>

+              </xsd:all>

+              </xsd:complexType>

+              </xsd:element>

+       </xsd:schema>

+

+       <xsd:schema targetNamespace="http://www.example.com/"

+              xmlns="http://www.w3.org/2000/10/XMLSchema">

+              <xsd:element name="GetProductsResponse">

+              <xsd:complexType>

+              <xsd:all>

+              <xsd:element name="products" type="tns:productDetailsType"/>

+              </xsd:all>

+              </xsd:complexType>

+              </xsd:element>

+       </xsd:schema>

+

+       

+    </wsdl:types>

+

+    <wsdl:message name="GetProductsRequest">

+        <wsdl:part name="in" element="tns:GetProductsRequest"/>

+    </wsdl:message>

+

+    <wsdl:message name="GetProductsResponse">

+        <wsdl:part name="out" element="tns:GetProductsResponse"/>

+    </wsdl:message>

+

+    <wsdl:portType name="OSCAdminPortType">

+        <wsdl:operation name="GetProducts">

+           <wsdl:input message="tns:GetProductsRequest"/>

+           <wsdl:output message="tns:GetProductsResponse"/>

+        </wsdl:operation>

+    </wsdl:portType>

+

+    <wsdl:binding name="OSCAdminSoapBinding" type="tns:OSCAdminPortType">

+        <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>

+        <wsdl:operation name="GetProducts">

+           <soap:operation soapAction=""/>

+           <wsdl:input name="in">

+               <soap:body use="literal"/>

+           </wsdl:input>

+           <wsdl:output name="out">

+               <soap:body use="literal"/>

+           </wsdl:output>

+        </wsdl:operation>

+    </wsdl:binding>

+

+    <wsdl:service name="OSCAdminService">

+        <wsdl:port name="OSCAdminPort" binding="tns:OSCAdminSoapBinding">

+           <soap:address location="test://"/>

+        </wsdl:port>

+    </wsdl:service>

+

+</wsdl:definitions>
\ No newline at end of file