Bug #73906 [NEW]: multi part response leads to segfault in Soapserver

From: mib at nic dot at Operating system: Linux PHP version: 7.0.14 Package: SOAP related Bug Type: Bug Bug description:multi part response leads to segfault in Soapserver Description: ------------ The Soapserver segfaults when generating a multi part response: To reproduce the bug: relevant WSDL parts: <message name="read"> <part name="label" type="xsd:string"/> </message> <message name="readResponse"> <part name="readResult" type="xsd:string"/> <part name="label" type="xsd:string"/> <part name="value1" type="xsd:string"/> </message> <portType name="SOAPCrash"> <operation name="read"> <input message="s0:read"/> <output message="s0:readResponse"/> </operation> </portType> ?> The code runs fine in PHP 5.5/5.6 but crashes 7.0.14/7.1 Test script: --------------- <?php ini_set("soap.wsdl_cache_enabled", "0"); // disabling WSDL cache $server = new SoapServer("../crash.wsdl"); $server->addFunction("read"); $server->handle(); function read ($label) { $return = array (new SoapParam("OK: $domain","readResult"), new SoapParam("$label","label"), new SoapParam("Value 1", "value1")); return $return; } ?> Actual result: -------------- (gdb) bt #0 strlen () at ../sysdeps/x86_64/strlen.S:106 #1 0x00007f372d4f64e3 in get_param (function=0x18, function@entry=0x7f37306af080, param_name=0x18 <error: Cannot access memory at address 0x18>, index=0, response=24, response@entry=1) at /build/php7.0-VhrlDZ/php7.0-7.0.14/ext/soap/soap.c:4496 #2 0x00007f372d4f6d2f in serialize_response_call2 (body=body@entry=0x7f373d2e4730, function=function@entry=0x7f37306af080, function_name=function_name@entry=0x7f37306b1450 "pollResponse", uri=uri@entry=0x7f373065d120 "http://XXXXXXXXXX/XXXXXX", ret=ret@entry=0x7ffc1a0e3f10, version=version@entry=1, main=main@entry=1, node=node@entry=0x0) at /build/php7.0-VhrlDZ/php7.0-7.0.14/ext/soap/soap.c:3829 #3 0x00007f372d4f734a in serialize_response_call (function=function@entry=0x7f37306af080, function_name=function_name@entry=0x7f37306b1450 "pollResponse", uri=0x7f373065d120 "http://www.ipcom.at/RcodeZero/SecondaryDNS", ret=ret@entry=0x7ffc1a0e3f10, headers=<optimized out>, version=version@entry=1) at /build/php7.0-VhrlDZ/php7.0-7.0.14/ext/soap/soap.c:4189 #4 0x00007f372d50261b in zim_SoapServer_handle (execute_data=<optimized out>, return_value=<optimized out>) at /build/php7.0-VhrlDZ/php7.0-7.0.14/ext/soap/soap.c:1915 #5 0x00007f37371ca44b in ?? () from /usr/lib/apache2/modules/libphp7.0.so #6 0x00007f373718c59b in execute_ex () from /usr/lib/apache2/modules/libphp7.0.so #7 0x00007f37371d5e0f in zend_execute () from /usr/lib/apache2/modules/libphp7.0.so #8 0x00007f373714ffc4 in zend_execute_scripts () from /usr/lib/apache2/modules/libphp7.0.so #9 0x00007f37370f2fd8 in php_execute_script () from /usr/lib/apache2/modules/libphp7.0.so #10 0x00007f37371d7752 in ?? () from /usr/lib/apache2/modules/libphp7.0.so #11 0x00007f373b5353f0 in ap_run_handler () #12 0x00007f373b535939 in ap_invoke_handler () #13 0x00007f373b54cd4a in ap_process_async_request () #14 0x00007f373b54d024 in ap_process_request () #15 0x00007f373b549005 in ?? () #16 0x00007f373b53f230 in ap_run_process_connection () #17 0x00007f373772aa20 in ?? () from /usr/lib/apache2/modules/mod_mpm_prefork.so #18 0x00007f373772acb2 in ?? () from /usr/lib/apache2/modules/mod_mpm_prefork.so #19 0x00007f373772ad1f in ?? () from /usr/lib/apache2/modules/mod_mpm_prefork.so #20 0x00007f373772bbff in ?? () from /usr/lib/apache2/modules/mod_mpm_prefork.so #21 0x00007f373b517f7e in ap_run_mpm () #22 0x00007f373b510ac8 in main () -- Edit bug report at https://bugs.php.net/bug.php?id=73906&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=73906&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=73906&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=73906&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=73906&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=73906&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=73906&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=73906&r=needscript Try newer version: https://bugs.php.net/fix.php?id=73906&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=73906&r=support Expected behavior: https://bugs.php.net/fix.php?id=73906&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=73906&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=73906&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=73906&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=73906&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=73906&r=dst IIS Stability: https://bugs.php.net/fix.php?id=73906&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=73906&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=73906&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=73906&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=73906&r=mysqlcfg