Fixed bug #55323 (SoapClient segmentation fault when XSD_TYPEKIND_EXTENSION contains itself)

1 files changed, 38 insertions, 1 deletions

diff --git a/ext/soap/php_encoding.c b/ext/soap/php_encoding.c
index 7ee031056f..8513498f4c 100644
--- a/ext/soap/php_encoding.c
+++ b/ext/soap/php_encoding.c
@@ -114,6 +114,26 @@ static void set_ns_and_type(xmlNodePtr node, encodeTypePtr type);
 		} \
 	}
 
+#define CHECK_XML_NULL(xml) \
+	{ \
+		xmlAttrPtr null; \
+		if (!xml) { \
+			zval *ret; \
+			ALLOC_INIT_ZVAL(ret); \
+			ZVAL_NULL(ret); \
+			return ret; \
+		} \
+		if (xml->properties) { \
+			null = get_attribute(xml->properties, "nil"); \
+			if (null) { \
+				zval *ret; \
+				ALLOC_INIT_ZVAL(ret); \
+				ZVAL_NULL(ret); \
+				return ret; \
+			} \
+		} \
+	}
+
 #define FIND_ZVAL_NULL(zval, xml, style) \
 { \
 	if (!zval || Z_TYPE_P(zval) == IS_NULL) { \
@@ -338,6 +358,19 @@ static zend_bool soap_check_zval_ref(zval *data, xmlNodePtr node TSRMLS_DC) {
 	return 0;
 }
 
+static zval* soap_find_xml_ref(xmlNodePtr node TSRMLS_DC)
+{
+	zval **data_ptr;
+
+	if (SOAP_GLOBAL(ref_map) && 
+	    zend_hash_index_find(SOAP_GLOBAL(ref_map), (ulong)node, (void**)&data_ptr) == SUCCESS) {
+		Z_SET_ISREF_PP(data_ptr);
+		Z_ADDREF_PP(data_ptr);
+		return *data_ptr;
+	}
+	return NULL;
+}
+
 static zend_bool soap_check_xml_ref(zval **data, xmlNodePtr node TSRMLS_DC)
 {
 	zval **data_ptr;
@@ -1513,6 +1546,11 @@ static zval *to_zval_object_ex(encodeTypePtr type, xmlNodePtr data, zend_class_e
 			    sdlType->encode->details.sdl_type->kind != XSD_TYPEKIND_LIST &&
 			    sdlType->encode->details.sdl_type->kind != XSD_TYPEKIND_UNION) {
 
+				CHECK_XML_NULL(data);
+				if ((ret = soap_find_xml_ref(data TSRMLS_CC)) != NULL) {
+					return ret;
+				}
+
 			    if (ce != ZEND_STANDARD_CLASS_DEF_PTR &&
 			        sdlType->encode->to_zval == sdl_guess_convert_zval &&
 			        sdlType->encode->details.sdl_type != NULL &&
@@ -1526,7 +1564,6 @@ static zval *to_zval_object_ex(encodeTypePtr type, xmlNodePtr data, zend_class_e
 			    } else {
 					ret = master_to_zval_int(sdlType->encode, data);
 				}
-				FIND_XML_NULL(data, ret);
 				if (soap_check_xml_ref(&ret, data TSRMLS_CC)) {
 					return ret;
 				}