Bug #69288 [Com]: Regression introduced in fix for bug 69085 leads to segmentation fault

Edit report at https://bugs.php.net/bug.php?id=69288&edit=1 ID: 69288 Comment by: tarik at opticempire dot com dot au Reported by: thomas at shadowweb dot org Summary: Regression introduced in fix for bug 69085 leads to segmentation fault Status: Closed Type: Bug Package: Reproducible crash PHP Version: 5.4.39 Assigned To: laruence Block user comment: N Private report: N New Comment: How is this one closed as its still evident in 5.4.39 Previous Comments: ------------------------------------------------------------------------ [2015-03-31 20:42:16] cmb@php.net Related To: Bug #69341 ------------------------------------------------------------------------ [2015-03-31 16:43:26] cmb@php.net Related To: Bug #69341 ------------------------------------------------------------------------ [2015-03-25 08:28:27] ondrej@php.net JFTR the crash has not been fixed in PHP-5.4 branch, just in this PHP-5.5 commit: https://github.com/php/php-src/commit/76c1ec5e96640e3076c105bde2cccfceb7557690 ------------------------------------------------------------------------ [2015-03-25 05:38:44] laruence@php.net oh....... I just committed a same fix for #69293, didn't see your report and patch :< anyway, thanks for the reporting and fix ------------------------------------------------------------------------ [2015-03-24 14:24:06] thomas at shadowweb dot org Description: ------------ A bug/regression introduced in commit c8eaca013a3922e8383def6158ece2b63f6ec483 (for PHP 5.4) and b3ac3522534a75edb76312cf9a576e4624372123 (Merge to PHP 5.5) leads to reproductible segmentation faults, when using SOAP with PHP versions 5.4.39 and 5.5.23. I will not include a testscript, since the bug is obvious from the commit: - if (zend_hash_find(ht, "enc_namens", sizeof("enc_namens"), (void **)&znamens) == SUCCESS) { + if (zend_hash_find(ht, "enc_namens", sizeof("enc_namens"), (void **)&znamens) == SUCCESS && + Z_TYPE_PP(zname) == IS_STRING) { xmlNsPtr nsp = encode_add_ns(node, Z_STRVAL_PP(znamens)); xmlSetNs(node, nsp); } "Z_TYPE_PP(zname) == IS_STRING" should be "Z_TYPE_PP(znamens)", the included patch is for PHP 5.4.39. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=69288&edit=1