diff options
| author | Dmitry Stogov <dmitry@php.net> | 2011-11-28 14:20:35 +0000 |
|---|---|---|
| committer | Dmitry Stogov <dmitry@php.net> | 2011-11-28 14:20:35 +0000 |
| commit | d1432d434cfd8f072d4a586b2688b006af54e1b5 (patch) | |
| tree | a617611253817e383067fbffbd460fd2fab465c9 /ext/soap | |
| parent | 43a373437d27225036d523dcec5adbd6aba1014a (diff) | |
| download | php-git-d1432d434cfd8f072d4a586b2688b006af54e1b5.tar.gz | |
Fixed bug #54911 (Access to a undefined member in inherit SoapClient may cause Segmentation Fault)
Diffstat (limited to 'ext/soap')
| -rw-r--r-- | ext/soap/soap.c | 11 | ||||
| -rw-r--r-- | ext/soap/tests/bugs/bug54911.phpt | 22 |
2 files changed, 33 insertions, 0 deletions
diff --git a/ext/soap/soap.c b/ext/soap/soap.c index 13a7b9e9f2..b94e783360 100644 --- a/ext/soap/soap.c +++ b/ext/soap/soap.c @@ -99,6 +99,7 @@ static void soap_error_handler(int error_num, const char *error_filename, const zend_bool _old_in_compilation = CG(in_compilation); \ zend_bool _old_in_execution = EG(in_execution); \ zend_execute_data *_old_current_execute_data = EG(current_execute_data); \ + void **_old_stack_top = EG(argument_stack)->top; \ int _bailout = 0;\ SOAP_GLOBAL(use_soap_error_handler) = 1;\ SOAP_GLOBAL(error_code) = "Client";\ @@ -115,6 +116,16 @@ static void soap_error_handler(int error_num, const char *error_filename, const !instanceof_function(Z_OBJCE_P(EG(exception)), soap_fault_class_entry TSRMLS_CC)) {\ _bailout = 1;\ }\ + if (_old_stack_top != EG(argument_stack)->top) { \ + while (EG(argument_stack)->prev != NULL && \ + ((char*)_old_stack_top < (char*)EG(argument_stack) || \ + (char*) _old_stack_top > (char*)EG(argument_stack)->end)) { \ + zend_vm_stack tmp = EG(argument_stack)->prev; \ + efree(EG(argument_stack)); \ + EG(argument_stack) = tmp; \ + } \ + EG(argument_stack)->top = _old_stack_top; \ + } \ } zend_end_try();\ SOAP_GLOBAL(use_soap_error_handler) = _old_handler;\ SOAP_GLOBAL(error_code) = _old_error_code;\ diff --git a/ext/soap/tests/bugs/bug54911.phpt b/ext/soap/tests/bugs/bug54911.phpt new file mode 100644 index 0000000000..da57383ac7 --- /dev/null +++ b/ext/soap/tests/bugs/bug54911.phpt @@ -0,0 +1,22 @@ +--TEST-- +Bug #54911 (Access to a undefined member in inherit SoapClient may cause Segmentation Fault) +--SKIPIF-- +<?php require_once('skipif.inc'); ?> +--FILE-- +<?php + class XSoapClient extends SoapClient { + function __doRequest($request, $location, $action, $version, $one_way=false) { + echo self::$crash; + } + } + $client = new XSoapClient(null, array('uri'=>'', 'location'=>'')); + $client->__soapCall('', array()); +?> +--EXPECTF-- +Fatal error: Uncaught SoapFault exception: [Client] Access to undeclared static property: XSoapClient::$crash in %sbug54911.php:4 +Stack trace: +#0 %sbug54911.php(4): XSoapClient::__doRequest() +#1 [internal function]: XSoapClient->__doRequest('<?xml version="...', '', '#', 1, 0) +#2 %sbug54911.php(8): SoapClient->__soapCall('', Array) +#3 {main} + thrown in %sbug54911.php on line 4
\ No newline at end of file |