Bug #66049 [NEW]: Typemap can break parsing in parse_packet_soap leading to a segfault

From: martin dot koegler at brz dot gv dot at Operating system: Any PHP version: 5.5.5 Package: SOAP related Bug Type: Bug Bug description:Typemap can break parsing in parse_packet_soap leading to a segfault Description: ------------ parse_packet_soap extracts various data from the response with the following sequence: zval *zv = master_to_zval(get_conversion(IS_STRING), tmp TSRMLS_CC); faultstring = Z_STRVAL_P(zv); It assumes, that zv contains a string, but a typemap allow master_to_zval to return a different type. Accessing that a different type as string usually least to a segfault via parse_packet_soap => add_soap_fault => set_soap_fault => add_property_string_ex => crash in strlen Easiest workaround is to force the string data type via convert_to_string_ex(&zv); before accessing Z_STRVAL_P(zv). Test script: --------------- Take any wsdl as test.wsdl and point it to server.php as URL. Adapt client.php to call a existing operation of the wsdl: client.php: <?php function soap_string_from_xml($str) { return new stdClass(); } $client=new soapclient("test.wsdl", array('typemap'=>array( array("type_ns"=>"http://www.w3.org/2001/XMLSchema", "type_name"=>"string", "from_xml"=>"soap_string_from_xml") ))); $client->Mist(""); ?> server.php: <?php header("Content-Type: text/xml"); header("HTTP/1.0 500 Internal Error");?> <?xml version="1.0" encoding="UTF-8"?> <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"><SOAP-ENV:Body><SOAP-ENV:Fault><faultcode>SOAP-ENV:Server</faultcode><faultstring>not present</faultstring></SOAP-ENV:Fault></SOAP-ENV:Body></SOAP-ENV:Envelope> -- Edit bug report at https://bugs.php.net/bug.php?id=66049&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=66049&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=66049&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=66049&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=66049&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=66049&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=66049&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=66049&r=needscript Try newer version: https://bugs.php.net/fix.php?id=66049&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=66049&r=support Expected behavior: https://bugs.php.net/fix.php?id=66049&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=66049&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=66049&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=66049&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=66049&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=66049&r=dst IIS Stability: https://bugs.php.net/fix.php?id=66049&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=66049&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=66049&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=66049&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=66049&r=mysqlcfg