Bug #70032 [NEW]: make_http_soap_request calls zend_hash_get_current_key_ex(,,,NULL)

From: turchanov at farpost dot com Operating system: Linux PHP version: 7.0.0alpha2 Package: SOAP related Bug Type: Bug Bug description:make_http_soap_request calls zend_hash_get_current_key_ex(,,,NULL) Description: ------------ make_http_soap_request at php_http.c:817 makes a call ... zend_hash_get_current_key_ex(Z_ARRVAL_P(cookies), &key, NULL, NULL); ... But implementation of zend_hash_get_current_key_ex does dereferencing of 'pos' parameter without checking it is not NULL: ZEND_API int ZEND_FASTCALL zend_hash_get_current_key_ex(const HashTable *ht, zend_string **str_index, zend_ulong *num_index, HashPosition *pos) { uint32_t idx = *pos; /* !!!!!! */ in php 5.6.x the same function does checking: ZEND_API int zend_hash_get_current_key_ex(const HashTable *ht, char **str_index, uint *str_length, ulong *num_index, zend_bool duplicate, HashPosition *pos) { Bucket *p; p = pos ? (*pos) : ht->pInternalPointer; Actual result: -------------- Program terminated with signal 11, Segmentation fault. #0 zend_hash_get_current_key_ex (ht=0x7f908a4a04d0, str_index=0x7fff0b8eee40, num_index=0x0, pos=0x0) at /usr/src/debug/php-src-master/Zend/zend_hash.c:2032 2032 uint32_t idx = *pos; (gdb) bt #0 zend_hash_get_current_key_ex (ht=0x7f908a4a04d0, str_index=0x7fff0b8eee40, num_index=0x0, pos=0x0) at /usr/src/debug/php-src-master/Zend/zend_hash.c:2032 #1 0x00000000006fb368 in make_http_soap_request (this_ptr=<value optimized out>, buf=0x7f908a3f9318 "<?xml version=\"1.0\""..., buf_size=<value optimized out>, location=<value optimized out>, soapaction=<value optimized out>, soap_version=1, return_value=0x7f909d815050) at /usr/src/debug/php-src-master/ext/soap/php_http.c:817 -- Edit bug report at https://bugs.php.net/bug.php?id=70032&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=70032&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=70032&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=70032&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=70032&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=70032&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=70032&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=70032&r=needscript Try newer version: https://bugs.php.net/fix.php?id=70032&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=70032&r=support Expected behavior: https://bugs.php.net/fix.php?id=70032&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=70032&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=70032&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=70032&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=70032&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=70032&r=dst IIS Stability: https://bugs.php.net/fix.php?id=70032&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=70032&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=70032&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=70032&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=70032&r=mysqlcfg