Bug #69341 [Opn]: segfault when complex SoapHeader given - reproducable

Edit report at https://bugs.php.net/bug.php?id=69341&edit=1 ID: 69341 User updated by: wuerfl at it-wuerfl dot de Reported by: wuerfl at it-wuerfl dot de Summary: segfault when complex SoapHeader given - reproducable Status: Open Type: Bug Package: SOAP related Operating System: Linux (Ubuntu/Red Hat Santiago) PHP Version: 5.5.23 Block user comment: N Private report: N New Comment: i found the error source, please look in ext/soap/php_encoding.c in LINE 466 if (zend_hash_find(ht, "enc_namens", sizeof("enc_namens"), (void **)&znamens) == SUCCESS && Z_TYPE_PP(zname) == IS_STRING) { Should it be : Z_TYPE_PP(znamens) instead of zname? Previous Comments: ------------------------------------------------------------------------ [2015-03-31 16:43:26] cmb@php.net Probably related to bug #69288 and bug #69293. ------------------------------------------------------------------------ [2015-03-31 16:06:18] wuerfl at it-wuerfl dot de Description: ------------ We have the bug under magento (but is a general bug), always when a complex SoapHeader is given, soap.so segfaults in PHP-FPM Module Test script: --------------- $soapclient = new SoapClient($loggingSoapClientParameters); $auth = array( 'UsernameToken'=> array('Username'=>$username,'Password'=>$password) ); $ns = 'http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd'; $ns = 'http://example.com/'; Mage::log($wsseAuthHeader); $auth = new SoapVar($auth, SOAP_ENC_ARRAY, NULL, $ns , NULL, $ns); $wsseAuthHeader = new SoapHeader($ns,'Security',$auth,true); $soapClient->__setSoapHeaders(array($wsseAuthHeader)); $requestGetSecurityToken = new stdClass(); $requestGetSecurityToken->UsesCount = 10; $parameter = array("request" => $requestGetSecurityToken); // execute the request $soapResponse = $soapClient->GetSecurityToken($parameter); Expected result: ---------------- no segfault Actual result: -------------- Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Program received signal SIGSEGV, Segmentation fault. master_to_xml_int (encode=encode@entry=0x0, data=<optimized out>, style=style@entry=2, parent=parent@entry=0x1110930, check_class_map=check_class_map@entry=1) at /usr/src/php/ext/soap/php_encoding.c:466 466 if (zend_hash_find(ht, "enc_namens", sizeof("enc_namens"), (void **)&znamens) == SUCCESS && (gdb) bt #0 master_to_xml_int (encode=encode@entry=0x0, data=<optimized out>, style=style@entry=2, parent=parent@entry=0x1110930, check_class_map=check_class_map@entry=1) at /usr/src/php/ext/soap/php_encoding.c:466 #1 0x00007ffff0a31a3b in master_to_xml (encode=encode@entry=0x0, data=<optimized out>, style=style@entry=2, parent=parent@entry=0x1110930) at /usr/src/php/ext/soap/php_encoding.c:539 #2 0x00007ffff0a25ef8 in serialize_function_call (this_ptr=<optimized out>, function=<optimized out>, function_name=<optimized out>, uri=<optimized out>, arguments=<optimized out>, arg_count=<optimized out>, version=1, soap_headers=0x187a6d8) at /usr/src/php/ext/soap/soap.c:4377 #3 0x00007ffff0a2bf9d in do_soap_call (this_ptr=0x177c0bb, this_ptr@entry=0x178bf40, function=0x7ffff0a595e3 "O", arg_count=24625328, arg_count@entry=1, real_args=0x736e, real_args@entry=0x0, return_value=0x4, return_value@entry=0x187a6d8, location=0x652fb767fe9 <error: Cannot access memory at address 0x652fb767fe9>, location@entry=0x0, soap_action=0x0, call_uri=0x0, soap_headers=0x187a6d8, output_headers=0x0, function_len=<optimized out>) at /usr/src/php/ext/soap/soap.c:2719 #4 0x00007ffff0a2c779 in zim_SoapClient___call (ht=<optimized out>, return_value=<optimized out>, return_value_ptr=<optimized out>, this_ptr=0x178bf40, return_value_used=<optimized out>) at /usr/src/php/ext/soap/soap.c:2943 #5 0x00007ffff23e16e5 in xdebug_execute_internal (current_execute_data=0x7fffffff9b60, fci=0x7fffffff9ca0, return_value_used=1) at /tmp/xdebug/xdebug.c:1651 #6 0x00000000006de9b5 in zend_call_function () #7 0x000000000070314c in zend_call_method () #8 0x000000000070f1dd in zend_std_call_user_call () #9 0x00007ffff23e16e5 in xdebug_execute_internal (current_execute_data=0x7ffff7fa2670, fci=0x0, return_value_used=1) at /tmp/xdebug/xdebug.c:1651 #10 0x00000000007a2f8e in ?? () #11 0x0000000000715af0 in execute_ex () #12 0x00007ffff23e0dc2 in xdebug_execute_ex (execute_data=0x7ffff7fa2670) at /tmp/xdebug/xdebug.c:1526 #13 0x00000000007a33a7 in ?? () #14 0x0000000000715af0 in execute_ex () #15 0x00007ffff23e0dc2 in xdebug_execute_ex (execute_data=0x7ffff7fa2180) at /tmp/xdebug/xdebug.c:1526 #16 0x00000000006ed9c0 in zend_execute_scripts () #17 0x000000000068e908 in php_execute_script () #18 0x00000000007a4faf in ?? () #19 0x000000000042ddb7 in ?? () #20 0x00007ffff5a1eb45 in __libc_start_main (main=0x42d990, argc=2, argv=0x7fffffffdb78, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffdb68) at libc-start.c:287 #21 0x000000000042def8 in _start () ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=69341&edit=1