Bug #70993 [Com]: Array key references break argument processing

Edit report at https://bugs.php.net/bug.php?id=70993&edit=1 ID: 70993 Comment by: php at ontheroad dot net dot nz Reported by: php at ontheroad dot net dot nz Summary: Array key references break argument processing Status: Feedback Type: Bug Package: SOAP related Operating System: Ubuntu 14.04 PHP Version: 7.0.0RC8 Assigned To: laruence Block user comment: N Private report: N New Comment: Yes, your patch does resolve the problem for me. Thanks for such a quick response and my apologies for not being able to give a more reproducible test case for you (but good guess). Previous Comments: ------------------------------------------------------------------------ [2015-11-29 15:24:52] laruence@php.net I can not produce this, so I only can give a guess, could you please try to verify whether this fix works? diff --git a/ext/soap/soap.c b/ext/soap/soap.c index 4c746aa..219169d 100644 --- a/ext/soap/soap.c +++ b/ext/soap/soap.c @@ -2940,6 +2940,7 @@ PHP_METHOD(SoapClient, __call) if (arg_count > 0) { real_args = safe_emalloc(sizeof(zval), arg_count, 0); ZEND_HASH_FOREACH_VAL(Z_ARRVAL_P(args), param) { + ZVAL_DEREF(param); /*zval_add_ref(param);*/ ZVAL_COPY_VALUE(&real_args[i], param); i++; ------------------------------------------------------------------------ [2015-11-29 04:35:15] php at ontheroad dot net dot nz Description: ------------ Using references to array keys in arguments to SOAP calls seems to break the argument processing of SOAP arguments. This works fine in PHP 5.5 but breaks in PHP 7.0.0RC8. PHP7.0.0RC8 configuration './configure' '--prefix=/usr/local/php7' '--with-config-file-scan-dir=/usr/local/php7/etc/conf.d' '--enable-bcmath' '--with-bz2' '--enable-calendar' '--enable-intl' '--enable-exif' '--enable-dba' '--enable-ftp' '--with-gettext' '--with-gd' '--with-jpeg-dir' '--enable-mbstring' '--with-mcrypt' '--with-mhash' '--enable-mysqlnd' '--with-mysql=mysqlnd' '--with-mysql-sock=/var/run/mysqld/mysqld.sock' '--with-mysqli=mysqlnd' '--with-pdo-mysql=mysqlnd' '--with-openssl' '--enable-pcntl' '--with-pspell' '--enable-shmop' '--enable-soap' '--enable-sockets' '--enable-sysvmsg' '--enable-sysvsem' '--enable-sysvshm' '--enable-wddx' '--with-zlib' '--enable-zip' '--with-readline' '--with-curl' '--enable-fpm' '--with-fpm-user=www-data' '--with-fpm-group=www-data No modifications to php.ini. The web services in question are not public, so I can't provide a completely working example, however it seems like the behaviour should be independent of the service itself (although possibly it does somehow depend on the service definition) and it may not be related to SOAP at all, but this is the situation in which I've seen it. The example provides two SoapClient children which pre-process the arguments given. Both do the same thing, but one creates assigns a variable with a reference while one assigns a variable without. The only difference is the reference assignment, but the one with the reference ends up not processing the arguments at all and passing a request without arguments. The key line in the example is 32 (https://gist.github.com/anonymous/6d20b14d0f5fedbc04ca#file-example-php-L32bug-example-L17), where we assign a reference to $params[0]; the array index already exists, so it's not created by the assignment, but we can see on line 18 (https://gist.github.com/anonymous/6d20b14d0f5fedbc04ca#file-example-php-L18) that the SoapClientFine class does exactly the same but without a reference and it works OK. Recompiling with --enable-debug and running valgrind as described in https://bugs.php.net/bugs-getting-valgrind-log.php shows no difference between runs with the SoapClientFine and with the SoapClientBroken (0 definitely/indirectly/possibly lost, 54 blocks still reachable). Test script: --------------- Example is at https://gist.github.com/anonymous/6d20b14d0f5fedbc04ca Expected/Actual results are at https://gist.github.com/anonymous/c7bd9d0cf1c4246beb69 due to spam detection not letting me include it below. Expected result: ---------------- See https://gist.github.com/anonymous/c7bd9d0cf1c4246beb69 Actual result: -------------- See https://gist.github.com/anonymous/c7bd9d0cf1c4246beb69 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=70993&edit=1