Fixed bug #40609 (Segfaults when using more than one SoapVar in a request). (Rob, Dmitry)

3 files changed, 58 insertions, 1 deletions

diff --git a/ext/soap/php_encoding.c b/ext/soap/php_encoding.c
index f86b9d6045..53b7fa1f3f 100644
--- a/ext/soap/php_encoding.c
+++ b/ext/soap/php_encoding.c
@@ -2888,8 +2888,18 @@ static xmlNodePtr to_xml_any(encodeTypePtr type, zval *data, int style, xmlNodeP
 		ret = xmlNewTextLen(BAD_CAST(Z_STRVAL(tmp)), Z_STRLEN(tmp));
 		zval_dtor(&tmp);
 	}
+
 	ret->name = xmlStringTextNoenc;
-	xmlAddChild(parent, ret);
+	ret->parent = parent;
+	ret->doc = parent->doc;
+	ret->prev = parent->last;
+	ret->next = NULL;
+	if (parent->last) {
+		parent->last->next = ret;
+	} else {
+		parent->children = ret;
+	}
+	parent->last = ret;
 
 	return ret;
 }
diff --git a/ext/soap/tests/bugs/bug40609.phpt b/ext/soap/tests/bugs/bug40609.phpt
new file mode 100755
index 0000000000..b6349c21f3
--- /dev/null
+++ b/ext/soap/tests/bugs/bug40609.phpt
@@ -0,0 +1,21 @@
+--TEST--
+Bug #40609 (Segfaults when using more than one SoapVar in a request)
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--INI--
+soap.wsdl_cache_enabled=0
+--FILE--
+<?php
+ini_set("soap.wsdl_cache_enabled", 0);
+
+$c = new SoapClient(dirname(__FILE__)."/bug40609.wsdl", array('trace' => 1,' exceptions' => 0));
+
+$c->update(array('symbol' => new SoapVar("<symbol>MSFT</symbol>", XSD_ANYXML),
+                 'price' =>  new SoapVar("<price>1000</price>", XSD_ANYXML)));
+echo $c->__getLastRequest();
+echo "ok\n";
+?>
+--EXPECT--
+<?xml version="1.0" encoding="UTF-8"?>
+<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="http://quickstart.samples/xsd"><SOAP-ENV:Body><ns1:update><symbol>MSFT</symbol><price>1000</price></ns1:update></SOAP-ENV:Body></SOAP-ENV:Envelope>
+ok
diff --git a/ext/soap/tests/bugs/bug40609.wsdl b/ext/soap/tests/bugs/bug40609.wsdl
new file mode 100755
index 0000000000..d396d06f32
--- /dev/null
+++ b/ext/soap/tests/bugs/bug40609.wsdl
@@ -0,0 +1,26 @@
+<wsdl:definitions xmlns:axis2="http://quickstart.samples/" xmlns:http="http://schemas.xmlsoap.org/wsdl/http/" xmlns:mime="http://schemas.xmlsoap.org/wsdl/mime/" xmlns:soap12="http://schemas.xmlsoap.org/wsdl/soap12/" xmlns:ns="http://quickstart.samples/xsd" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/" targetNamespace="http://quickstart.samples/"><wsdl:documentation>

+        Stock Quote Service

+    </wsdl:documentation><wsdl:types><xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" attributeFormDefault="qualified" elementFormDefault="qualified" targetNamespace="http://quickstart.samples/xsd">

+<xs:element name="getPrice">

+<xs:complexType>

+<xs:sequence>

+<xs:element name="symbol" nillable="true" type="xs:string" />

+</xs:sequence>

+</xs:complexType>

+</xs:element>

+<xs:element name="getPriceResponse">

+<xs:complexType>

+<xs:sequence>

+<xs:element name="return" nillable="true" type="xs:double" />

+</xs:sequence>

+</xs:complexType>

+</xs:element>

+<xs:element name="update">

+<xs:complexType>

+<xs:sequence>

+<xs:element name="symbol" nillable="true" type="xs:any" />

+<xs:element name="price" nillable="true" type="xs:any" />

+</xs:sequence>

+</xs:complexType>

+</xs:element>

+</xs:schema></wsdl:types><wsdl:message name="updateMessage"><wsdl:part name="part1" element="ns:update" /></wsdl:message><wsdl:message name="getPriceMessage"><wsdl:part name="part1" element="ns:getPrice" /></wsdl:message><wsdl:message name="getPriceResponseMessage"><wsdl:part name="part1" element="ns:getPriceResponse" /></wsdl:message><wsdl:portType name="StockQuoteServicePortType"><wsdl:operation name="update"><wsdl:input xmlns:wsaw="http://www.w3.org/2006/05/addressing/wsdl" message="axis2:updateMessage" wsaw:Action="urn:update" /></wsdl:operation><wsdl:operation name="getPrice"><wsdl:input xmlns:wsaw="http://www.w3.org/2006/05/addressing/wsdl" message="axis2:getPriceMessage" wsaw:Action="urn:getPrice" /><wsdl:output xmlns:wsaw="http://www.w3.org/2006/05/addressing/wsdl" message="axis2:getPriceResponseMessage" wsaw:Action="http://quickstart.samples/StockQuoteServicePortType/getPriceResponse" /></wsdl:operation></wsdl:portType><wsdl:binding name="StockQuoteServiceSOAP11Binding" type="axis2:StockQuoteServicePortType"><soap:binding transport="http://schemas.xmlsoap.org/soap/http" style="document" /><wsdl:operation name="update"><soap:operation soapAction="urn:update" style="document" /><wsdl:input><soap:body use="literal" /></wsdl:input></wsdl:operation><wsdl:operation name="getPrice"><soap:operation soapAction="urn:getPrice" style="document" /><wsdl:input><soap:body use="literal" /></wsdl:input><wsdl:output><soap:body use="literal" /></wsdl:output></wsdl:operation></wsdl:binding><wsdl:binding name="StockQuoteServiceSOAP12Binding" type="axis2:StockQuoteServicePortType"><soap12:binding transport="http://schemas.xmlsoap.org/soap/http" style="document" /><wsdl:operation name="update"><soap12:operation soapAction="urn:update" style="document" /><wsdl:input><soap12:body use="literal" /></wsdl:input></wsdl:operation><wsdl:operation name="getPrice"><soap12:operation soapAction="urn:getPrice" style="document" /><wsdl:input><soap12:body use="literal" /></wsdl:input><wsdl:output><soap12:body use="literal" /></wsdl:output></wsdl:operation></wsdl:binding><wsdl:binding name="StockQuoteServiceHttpBinding" type="axis2:StockQuoteServicePortType"><http:binding verb="POST" /><wsdl:operation name="update"><http:operation location="update" /><wsdl:input><mime:content type="text/xml" /></wsdl:input></wsdl:operation><wsdl:operation name="getPrice"><http:operation location="getPrice" /><wsdl:input><mime:content type="text/xml" /></wsdl:input><wsdl:output><mime:content type="text/xml" /></wsdl:output></wsdl:operation></wsdl:binding><wsdl:service name="StockQuoteService"><wsdl:port name="StockQuoteServiceSOAP11port_http" binding="axis2:StockQuoteServiceSOAP11Binding"><soap:address location="http://bluelines.org:8080/axis2/services/StockQuoteService" /></wsdl:port><wsdl:port name="StockQuoteServiceSOAP12port_http" binding="axis2:StockQuoteServiceSOAP12Binding"><soap12:address location="http://bluelines.org:8080/axis2/services/StockQuoteService" /></wsdl:port><wsdl:port name="StockQuoteServiceHttpport1" binding="axis2:StockQuoteServiceHttpBinding"><http:address location="test://" /></wsdl:port></wsdl:service></wsdl:definitions>
\ No newline at end of file