Fixed bug #47049 (SoapClient::__soapCall causes a segmentation fault)

4 files changed, 112 insertions, 1 deletions

diff --git a/NEWS b/NEWS
index b109a4ed26..58df92eb7a 100644
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,8 @@ PHP                                                                        NEWS
   (Matt)
 - Fixed bug #47399 (mb_check_encoding() returns true for some illegal SJIS
   characters). (for-bugs at hnw dot jp, Moriyoshi)
+- Fixed bug #47049 (SoapClient::__soapCall causes a segmentation fault).
+  (Dmitry)
 - Fixed bug #45940 (MySQLI OO does not populate connect_error property on
   failed connect). (Johannes)
 - Fixed bug #45923 (mb_st[r]ripos() offset not handled correctly). (Moriyoshi)
diff --git a/ext/soap/soap.c b/ext/soap/soap.c
index a4b4e1bf29..ca2b0668fe 100644
--- a/ext/soap/soap.c
+++ b/ext/soap/soap.c
@@ -4187,7 +4187,17 @@ static xmlDocPtr serialize_function_call(zval *this_ptr, sdlFunctionPtr function
 		/*style = SOAP_RPC;*/
 		if (style == SOAP_RPC) {
 			ns = encode_add_ns(body, uri);
-			method = xmlNewChild(body, ns, BAD_CAST(function_name), NULL);
+			if (function_name) {
+				method = xmlNewChild(body, ns, BAD_CAST(function_name), NULL);
+			} else if (function && function->requestName) {
+				method = xmlNewChild(body, ns, BAD_CAST(function->requestName), NULL);
+			} else if (function && function->functionName) {
+				method = xmlNewChild(body, ns, BAD_CAST(function->functionName), NULL);
+			} else {
+				method = body;
+			}
+		} else {
+			method = body;
 		}
 
 		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "use", sizeof("use"), (void **)&zuse) == SUCCESS &&
diff --git a/ext/soap/tests/bugs/bug47049.phpt b/ext/soap/tests/bugs/bug47049.phpt
new file mode 100644
index 0000000000..bdc16274e2
--- /dev/null
+++ b/ext/soap/tests/bugs/bug47049.phpt
@@ -0,0 +1,19 @@
+--TEST--
+Bug #47049 (SoapClient::__soapCall causes a segmentation fault)
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--INI--
+soap.wsdl_cache_enabled=0
+--FILE--
+<?php
+$client = new SoapClient(dirname(__FILE__) . '/bug47049.wsdl',
+	array('trace' => 1 , 'exceptions' => 0));
+$host = array('uuid' => 'foo');
+$software_list = array(array('name' => 'package', 'version' => '1.2.3', 'state' => 'installed'));
+$updates = array();
+$report_id = $client->__soapCall('reportSoftwareStatus',array($host, $software_list, $updates));
+echo $client->__getLastRequest();
+?>
+--EXPECT--
+<?xml version="1.0" encoding="UTF-8"?>
+<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="http://www.example.org/reporter/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><ns1:reportSoftwareStatus><host xsi:type="ns1:host"><uuid xsi:type="xsd:string">foo</uuid></host><software_list xsi:type="ns1:software_list"><software xsi:type="ns1:software"><name xsi:type="xsd:string">package</name><version xsi:type="xsd:string">1.2.3</version><state xsi:type="xsd:string">installed</state></software></software_list><updates xsi:type="ns1:updates"/></ns1:reportSoftwareStatus></SOAP-ENV:Body></SOAP-ENV:Envelope>
diff --git a/ext/soap/tests/bugs/bug47049.wsdl b/ext/soap/tests/bugs/bug47049.wsdl
new file mode 100644
index 0000000000..b5730a38eb
--- /dev/null
+++ b/ext/soap/tests/bugs/bug47049.wsdl
@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<wsdl:definitions xmlns:http="http://schemas.xmlsoap.org/wsdl/http/" xmlns:mime="http://schemas.xmlsoap.org/wsdl/mime/" xmlns:tns="http://www.example.org/reporter/" xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" name="reporter" targetNamespace="http://www.example.org/reporter/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/">
+    <wsdl:types><xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema" targetNamespace="http://www.example.org/reporter/">
+        <xsd:complexType name="host">
+                <xsd:sequence>
+                        <xsd:element name="uuid" type="xsd:string"></xsd:element>
+                </xsd:sequence>
+        </xsd:complexType>
+        <xsd:complexType name="software_list">
+                <xsd:sequence>
+                        <xsd:element name="software" type="tns:software"
+                                maxOccurs="unbounded" minOccurs="1">
+                        </xsd:element>
+                </xsd:sequence>
+        </xsd:complexType>
+        <xsd:complexType name="software">
+                <xsd:sequence>
+                        <xsd:element name="name" type="xsd:string" maxOccurs="1" minOccurs="1"></xsd:element>
+                        <xsd:element name="version" type="xsd:string" maxOccurs="1" minOccurs="1"></xsd:element>
+                    <xsd:element name="state" type="xsd:string" maxOccurs="1" minOccurs="1"></xsd:element>
+                </xsd:sequence>
+        </xsd:complexType>
+        <xsd:complexType name="updates">
+                <xsd:sequence>
+                        <xsd:element name="update" type="tns:update"
+                                maxOccurs="unbounded" minOccurs="0">
+                        </xsd:element>
+                </xsd:sequence>
+        </xsd:complexType>
+
+        <xsd:complexType name="update">
+                <xsd:sequence>
+                        <xsd:element name="software" type="xsd:string"></xsd:element>
+                        <xsd:element name="old_version" type="xsd:string"></xsd:element>
+                        <xsd:element name="new_version" type="xsd:string"></xsd:element>
+                </xsd:sequence>
+        </xsd:complexType>
+
+</xsd:schema></wsdl:types>
+    <wsdl:message name="reportSoftwareStatusRequest">
+    <wsdl:part name="host" type="tns:host"/>
+    <wsdl:part name="software_list" type="tns:software_list"></wsdl:part>
+    <wsdl:part name="updates" type="tns:updates"></wsdl:part>
+    </wsdl:message>
+  <wsdl:message name="reportSoftwareStatusResponse">
+    <wsdl:part name="report_id" type="xsd:int"/>
+  </wsdl:message>
+  <wsdl:portType name="reporter">
+    <wsdl:operation name="reportSoftwareStatus">
+      <wsdl:input message="tns:reportSoftwareStatusRequest"/>
+      <wsdl:output message="tns:reportSoftwareStatusResponse"/>
+    </wsdl:operation>
+  </wsdl:portType>
+  <wsdl:binding name="reporterHTTP" type="tns:reporter">
+
+        <soap:binding style="document"
+                transport="http://schemas.xmlsoap.org/soap/http" />
+        <wsdl:operation name="reportSoftwareStatus">
+
+                <soap:operation
+                        soapAction="http://www.example.org/reporter/reportSoftwareStatus" />
+                <wsdl:input>
+
+
+                        <soap:body use="literal" />
+                </wsdl:input>
+                <wsdl:output>
+
+
+                        <soap:body use="literal" />
+                </wsdl:output>
+        </wsdl:operation>
+  </wsdl:binding>
+  <wsdl:service name="reporter">
+    <wsdl:port binding="tns:reporterHTTP" name="reporterHTTP">
+      <http:address location="test://"/>
+    </wsdl:port>
+  </wsdl:service>
+
+</wsdl:definitions>