Bug #54312 [Opn->Csd]: soap_version logic bug

Edit report at http://bugs.php.net/bug.php?id=54312&edit=1 ID: 54312 Updated by: felipe@php.net Reported by: tom at samplonius dot org Summary: soap_version logic bug -Status: Open +Status: Closed Type: Bug Package: SOAP related Operating System: CentOS 4 PHP Version: 5.3.6 -Assigned To: +Assigned To: felipe Block user comment: N Private report: N New Comment: This bug has been fixed in SVN. Snapshots of the sources are packaged every three hours; this change will be in the next snapshot. You can grab the snapshot at http://snaps.php.net/. Thank you for the report, and for helping us make PHP better. Thanks for the patch! :) Previous Comments: ------------------------------------------------------------------------ [2011-03-19 18:36:04] felipe@php.net Automatic comment from SVN on behalf of felipe Revision: http://svn.php.net/viewvc/?view=revision&revision=309433 Log: - Fixed bug #54312 (soap_version logic bug) Patch by: tom at samplonius dot org ------------------------------------------------------------------------ [2011-03-19 07:29:06] tom at samplonius dot org Description: ------------ This code in soap.c: if (zend_hash_find(ht, "soap_version", sizeof("soap_version"), (void**)&tmp) == SUCCESS) { if (Z_TYPE_PP(tmp) == IS_LONG || (Z_LVAL_PP(tmp) == SOAP_1_1 && Z_LVAL_PP(tmp) == SOAP_1_2)) { version = Z_LVAL_PP(tmp); } } has a problem with the second line of the inner if statement. Z_LVAL_PP(tmp) can't be both equal to SOAP_1_1 and SOAP_1_2, so this part will always be false. Plus, the "||" logic seems wrong too. It appears that if the type is IS_LONG, then any value is accepted. Patch is attached. It looks like the logic is inverted. || should && and && should be ||: if (zend_hash_find(ht, "soap_version", sizeof("soap_version"), (void**)&tmp) == SUCCESS) { if (Z_TYPE_PP(tmp) == IS_LONG && (Z_LVAL_PP(tmp) == SOAP_1_1 || Z_LVAL_PP(tmp) == SOAP_1_2)) { version = Z_LVAL_PP(tmp); } } ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/bug.php?id=54312&edit=1