Bug #71597 [Opn]: PHP7 regression: Crash when WSDL contains a union

Edit report at https://bugs.php.net/bug.php?id=71597&edit=1 ID: 71597 User updated by: cf0hay at gmail dot com Reported by: cf0hay at gmail dot com Summary: PHP7 regression: Crash when WSDL contains a union Status: Open Type: Bug Package: SOAP related Operating System: 64bit Linux PHP Version: 7.0.3 Block user comment: N Private report: N New Comment: Sorry for the noise. This one is with -O0 -g, with headers intact. Even turned off php.ini loading to use the builtin defaults. (gdb) run -n wstest_segfault.php Starting program: /var/tmp/portage/dev-lang/php-7.0.3/image/usr/lib64/php7.0/bin/php -n wstest_segfault.php [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib64/libthread_db.so.1". Program received signal SIGSEGV, Segmentation fault. 0x000000000071aea4 in to_xml_list (enc=0x7fffefc58c00, data=0x7fffefc5ea20, style=2, parent=0x14c9410) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/ext/soap/php_encoding.c:3057 3057 xmlNodeSetContentLen(ret, BAD_CAST(ZSTR_VAL(list.s)), ZSTR_LEN(list.s)); (gdb) bt #0 0x000000000071aea4 in to_xml_list (enc=0x7fffefc58c00, data=0x7fffefc5ea20, style=2, parent=0x14c9410) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/ext/soap/php_encoding.c:3057 #1 0x000000000071afc0 in to_xml_union (enc=0x7fffefc58c00, data=0x7fffefc5ea20, style=2, parent=0x14c9410) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/ext/soap/php_encoding.c:3077 #2 0x000000000071b6c1 in sdl_guess_convert_xml (enc=0x7fffefc58c00, data=0x7fffefc5ea20, style=2, parent=0x14c9410) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/ext/soap/php_encoding.c:3264 #3 0x0000000000710986 in master_to_xml_int (encode=0x7fffefc58c00, data=0x7fffefc5ea20, style=2, parent=0x14c9410, check_class_map=1) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/ext/soap/php_encoding.c:501 #4 0x0000000000710a00 in master_to_xml (encode=0x7fffefc58c00, data=0x7fffefc5ea20, style=2, parent=0x14c9410) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/ext/soap/php_encoding.c:512 #5 0x00000000007159fa in model_to_xml_object (node=0x14c9410, model=0x7fffefc01380, object=0x7fffefc64270, style=2, strict=1) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/ext/soap/php_encoding.c:1670 #6 0x0000000000715ede in model_to_xml_object (node=0x14c9410, model=0x7fffefc01310, object=0x7fffefc64270, style=2, strict=1) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/ext/soap/php_encoding.c:1742 #7 0x000000000071694d in to_xml_object (type=0x7fffefc58ae0, data=0x7fffefc64270, style=2, parent=0x14c5bc0) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/ext/soap/php_encoding.c:1913 #8 0x000000000071b724 in sdl_guess_convert_xml (enc=0x7fffefc58ae0, data=0x7fffefc64270, style=2, parent=0x14c5bc0) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/ext/soap/php_encoding.c:3274 #9 0x0000000000710986 in master_to_xml_int (encode=0x7fffefc58ae0, data=0x7fffefc64270, style=2, parent=0x14c5bc0, check_class_map=1) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/ext/soap/php_encoding.c:501 #10 0x0000000000710a00 in master_to_xml (encode=0x7fffefc58ae0, data=0x7fffefc64270, style=2, parent=0x14c5bc0) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/ext/soap/php_encoding.c:512 #11 0x000000000070d276 in serialize_zval (val=0x7fffefc64270, param=0x7fffefc63f40, paramName=0x7fffefc80208 "body", style=2, parent=0x14c5bc0) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/ext/soap/soap.c:4465 #12 0x000000000070d0d9 in serialize_parameter (param=0x7fffefc63f40, param_val=0x7fffefc64270, index=0, name=0x0, style=2, parent=0x14c5bc0) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/ext/soap/soap.c:4437 #13 0x000000000070c8fc in serialize_function_call (this_ptr=0x7fffefc14150, function=0x7fffefc58900, function_name=0x0, uri=0x0, arguments=0x7fffefc64270, arg_count=1, version=1, soap_headers=0x0) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/ext/soap/soap.c:4300 #14 0x00000000007062c3 in do_soap_call (execute_data=0x7fffefc14130, this_ptr=0x7fffefc14150, function=0x1418368 "notify", function_len=6, arg_count=1, real_args=0x7fffefc64270, return_value=0x7fffefc140f0, location=0x7fffefc014d0 "http://localhost/", soap_action=0x0, call_uri=0x0, soap_headers=0x0, output_headers=0x0) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/ext/soap/soap.c:2732 #15 0x0000000000707562 in zim_SoapClient___call (execute_data=0x7fffefc14130, return_value=0x7fffefc140f0) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/ext/soap/soap.c:2952 #16 0x00000000009cbaf2 in ZEND_CALL_TRAMPOLINE_SPEC_HANDLER () at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/Zend/zend_vm_execute.h:1809 #17 0x00000000009c75ea in execute_ex (ex=0x7fffefc14030) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/Zend/zend_vm_execute.h:414 #18 0x00000000009c76ff in zend_execute (op_array=0x7fffefc77100, return_value=0x0) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/Zend/zend_vm_execute.h:458 #19 0x0000000000968f25 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/Zend/zend.c:1427 #20 0x00000000008d2e4c in php_execute_script (primary_file=0x7fffffffc9f0) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/main/main.c:2484 #21 0x0000000000a308b5 in do_cli (argc=3, argv=0x130d9b0) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/sapi/cli/php_cli.c:974 #22 0x0000000000a31a72 in main (argc=3, argv=0x130d9b0) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/sapi/cli/php_cli.c:1345 Previous Comments: ------------------------------------------------------------------------ [2016-02-16 09:35:51] cf0hay at gmail dot com The previous one was stripped from debug information, but was compiled with -O0 (without compiler optimization) This one was with -O2, but with debug information: (gdb) run wstest_segfault.php Starting program: /usr/lib64/php7.0/bin/php wstest_segfault.php [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib64/libthread_db.so.1". Program received signal SIGSEGV, Segmentation fault. 0x0000000000642d00 in _zval_dtor (zvalue=<optimized out>, zvalue=<optimized out>) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/Zend/zend_variables.h:44 44 /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/Zend/zend_variables.h: Nincs ilyen fájl vagy könyvtár. (gdb) bt #0 0x0000000000642d00 in _zval_dtor (zvalue=<optimized out>, zvalue=<optimized out>) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/Zend/zend_variables.h:44 #1 to_xml_list (data=<optimized out>, style=style@entry=2, parent=<optimized out>, enc=<optimized out>) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/ext/soap/php_encoding.c:3060 #2 0x0000000000645f9f in to_xml_union (parent=<optimized out>, style=2, data=<optimized out>, enc=0x7fffefc55658) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/ext/soap/php_encoding.c:3077 #3 sdl_guess_convert_xml (enc=0x7fffefc55658, data=<optimized out>, style=2, parent=<optimized out>) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/ext/soap/php_encoding.c:3264 #4 0x0000000000642003 in master_to_xml_int (encode=encode@entry=0x7fffefc55658, data=0x7fffefc5ca20, style=style@entry=2, parent=parent@entry=0x1284120, check_class_map=check_class_map@entry=1) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/ext/soap/php_encoding.c:501 #5 0x00000000006426bb in master_to_xml (encode=encode@entry=0x7fffefc55658, data=<optimized out>, style=style@entry=2, parent=parent@entry=0x1284120) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/ext/soap/php_encoding.c:512 #6 0x00000000006451c9 in model_to_xml_object (node=node@entry=0x1284120, model=model@entry=0x7fffefc01180, object=object@entry=0x7fffefc620d0, style=style@entry=2, strict=<optimized out>) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/ext/soap/php_encoding.c:1670 #7 0x000000000064538e in model_to_xml_object (node=node@entry=0x1284120, model=<optimized out>, object=object@entry=0x7fffefc620d0, style=style@entry=2, strict=<optimized out>, strict@entry=1) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/ext/soap/php_encoding.c:1742 #8 0x000000000064591d in to_xml_object (type=0x7fffefc555b0, data=0x7fffefc620d0, style=2, parent=<optimized out>) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/ext/soap/php_encoding.c:1913 #9 0x0000000000642003 in master_to_xml_int (encode=encode@entry=0x7fffefc555b0, data=0x7fffefc620d0, style=style@entry=2, parent=0x12808d0, check_class_map=check_class_map@entry=1) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/ext/soap/php_encoding.c:501 #10 0x00000000006426bb in master_to_xml (encode=encode@entry=0x7fffefc555b0, data=<optimized out>, style=style@entry=2, parent=<optimized out>) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/ext/soap/php_encoding.c:512 #11 0x00000000006304b0 in serialize_zval (val=<optimized out>, val@entry=0x7fffefc620d0, param=param@entry=0x7fffefc61980, paramName=0x7fffefc80060 "body", style=style@entry=2, parent=<optimized out>) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/ext/soap/soap.c:4465 #12 0x0000000000630672 in serialize_parameter (param=param@entry=0x7fffefc61980, param_val=param_val@entry=0x7fffefc620d0, index=index@entry=0, name=<optimized out>, name@entry=0x0, style=style@entry=2, parent=parent@entry=0x12808d0) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/ext/soap/soap.c:4437 #13 0x00000000006347f9 in serialize_function_call (this_ptr=this_ptr@entry=0x7fffefc13150, function=function@entry=0x7fffefc63140, function_name=function_name@entry=0x0, uri=<optimized out>, arguments=arguments@entry=0x7fffefc620d0, arg_count=arg_count@entry=1, version=1, soap_headers=0x0) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/ext/soap/soap.c:4300 #14 0x000000000063d1d1 in do_soap_call (this_ptr=this_ptr@entry=0x7fffefc13150, function=0x11d4708 "notify", arg_count=1, real_args=0x7fffefc620d0, return_value=0x7fffefc130f0, location=0x7fffefc01210 "http://localhost/", soap_action=0x0, call_uri=0x0, soap_headers=0x0, output_headers=0x0, function_len=6, execute_data=0x7fffefc13130) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/ext/soap/soap.c:2732 #15 0x000000000063da3c in zim_SoapClient___call (execute_data=0x7fffefc13130, return_value=0x7fffefc130f0) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/ext/soap/soap.c:2952 #16 0x00000000008317a4 in ZEND_CALL_TRAMPOLINE_SPEC_HANDLER () at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/Zend/zend_vm_execute.h:1809 #17 0x00000000007e49ab in execute_ex (ex=<optimized out>) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/Zend/zend_vm_execute.h:414 #18 0x0000000000838727 in zend_execute (op_array=0x7fffefc8a000, op_array@entry=0x10c0908 <executor_globals+1480>, return_value=return_value@entry=0x7fffefc13030) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/Zend/zend_vm_execute.h:458 #19 0x00000000007a5c33 in zend_execute_scripts (type=type@entry=8, retval=0x7fffefc13030, retval@entry=0x0, file_count=file_count@entry=3) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/Zend/zend.c:1427 #20 0x00000000007474d0 in php_execute_script (primary_file=primary_file@entry=0x7fffffffc620) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/main/main.c:2484 #21 0x000000000083a3f9 in do_cli (argc=2, argv=0x10c5fa0) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/sapi/cli/php_cli.c:974 #22 0x00000000004858dd in main (argc=2, argv=0x10c5fa0) at /var/tmp/portage/dev-lang/php-7.0.3/work/sapis-build/cli/sapi/cli/php_cli.c:1345 ------------------------------------------------------------------------ [2016-02-16 09:14:05] cf0hay at gmail dot com $ gdb /usr/lib64/php7.0/bin/php GNU gdb (Gentoo 7.10.1 vanilla) 7.10.1 Copyright (C) 2015 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-pc-linux-gnu". Type "show configuration" for configuration details. For bug reporting instructions, please see: <https://bugs.gentoo.org/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from /usr/lib64/php7.0/bin/php...(no debugging symbols found)...done. (gdb) run wstest_segfault.php Starting program: /usr/lib64/php7.0/bin/php wstest_segfault.php [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib64/libthread_db.so.1". Program received signal SIGSEGV, Segmentation fault. 0x000000000071aea4 in ?? () (gdb) bt #0 0x000000000071aea4 in ?? () #1 0x000000000071afc0 in ?? () #2 0x000000000071b6c1 in sdl_guess_convert_xml () #3 0x0000000000710986 in ?? () #4 0x0000000000710a00 in master_to_xml () #5 0x00000000007159fa in ?? () #6 0x0000000000715ede in ?? () #7 0x000000000071694d in ?? () #8 0x000000000071b724 in sdl_guess_convert_xml () #9 0x0000000000710986 in ?? () #10 0x0000000000710a00 in master_to_xml () #11 0x000000000070d276 in ?? () #12 0x000000000070d0d9 in ?? () #13 0x000000000070c8fc in ?? () #14 0x00000000007062c3 in ?? () #15 0x0000000000707562 in zim_SoapClient___call () #16 0x00000000009cbaf2 in ?? () #17 0x00000000009c75ea in execute_ex () #18 0x00000000009c76ff in zend_execute () #19 0x0000000000968f25 in zend_execute_scripts () #20 0x00000000008d2e4c in php_execute_script () #21 0x0000000000a308b5 in ?? () #22 0x0000000000a31a72 in main () (gdb) ------------------------------------------------------------------------ [2016-02-16 02:54:53] laruence@php.net Thank you for this bug report. To properly diagnose the problem, we need a backtrace to see what is happening behind the scenes. To find out how to generate a backtrace, please read http://bugs.php.net/bugs-generating-backtrace.php for *NIX and http://bugs.php.net/bugs-generating-backtrace-win32.php for Win32 Once you have generated a backtrace, please submit it to this bug report and change the status back to "Open". Thank you for helping us make PHP better. I can not reproduce this, instead I get ouput: "Not Allow" ------------------------------------------------------------------------ [2016-02-15 12:49:03] cf0hay at gmail dot com test.wsdl: http://pastebin.com/raw/UkVXZe38 ------------------------------------------------------------------------ [2016-02-15 12:44:23] cf0hay at gmail dot com Description: ------------ PHP 7.0.3 crashes when making a soap request with a union simpleType. PHP 5.6 doesn't have this problem. Test script: --------------- #!/usr/bin/php <?php $soap = new SoapClient("test.wsdl", ['trace' => true]); try{ $resp = $soap->notify([ 'resourceId' => '', ]); }catch(SoapFault $e){ echo $e->getMessage()."\n"; } Expected result: ---------------- Could not connect to host Actual result: -------------- Segmentation Fault ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=71597&edit=1