Bug #73906 [Com]: multi part response leads to segfault in Soapserver
| From: | jonas at sitedirect dot se | Date: | Fri, 24 Nov 2017 12:53:39 +0000 |
| Subject: | Bug #73906 [Com]: multi part response leads to segfault in Soapserver | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-212712@lists.php.net to get a copy of this message | ||
Edit report at https://bugs.php.net/bug.php?id=73906&edit=1
ID: 73906
Comment by: jonas at sitedirect dot se
Reported by: mib at nic dot at
Summary: multi part response leads to segfault in Soapserver
Status: Open
Type: Bug
Package: SOAP related
Operating System: Linux
PHP Version: 7.0.14
Block user comment: N
Private report: N
New Comment:
Have the same issue but in 7.1.
Using OndÅej Surý Ubuntu PPA.
Previous Comments:
------------------------------------------------------------------------
[2017-01-10 13:34:17] mib at nic dot at
Description:
------------
The Soapserver segfaults when generating a multi part response:
To reproduce the bug:
relevant WSDL parts:
<message name="read">
<part name="label" type="xsd:string"/>
</message>
<message name="readResponse">
<part name="readResult" type="xsd:string"/>
<part name="label" type="xsd:string"/>
<part name="value1" type="xsd:string"/>
</message>
<portType name="SOAPCrash">
<operation name="read">
<input message="s0:read"/>
<output message="s0:readResponse"/>
</operation>
</portType>
?>
The code runs fine in PHP 5.5/5.6 but crashes 7.0.14/7.1
Test script:
---------------
<?php
ini_set("soap.wsdl_cache_enabled", "0"); // disabling WSDL cache
$server = new SoapServer("../crash.wsdl");
$server->addFunction("read");
$server->handle();
function read ($label) {
$return = array (new SoapParam("OK: $domain","readResult"),
new SoapParam("$label","label"),
new SoapParam("Value 1", "value1"));
return $return;
}
?>
Actual result:
--------------
(gdb) bt
#0 strlen () at ../sysdeps/x86_64/strlen.S:106
#1 0x00007f372d4f64e3 in get_param (function=0x18, function@entry=0x7f37306af080,
param_name=0x18 <error: Cannot access memory at address 0x18>, index=0, response=24,
response@entry=1)
at /build/php7.0-VhrlDZ/php7.0-7.0.14/ext/soap/soap.c:4496
#2 0x00007f372d4f6d2f in serialize_response_call2 (body=body@entry=0x7f373d2e4730,
function=function@entry=0x7f37306af080,
function_name=function_name@entry=0x7f37306b1450 "pollResponse",
uri=uri@entry=0x7f373065d120 "http://XXXXXXXXXX/XXXXXX",
ret=ret@entry=0x7ffc1a0e3f10, version=version@entry=1,
main=main@entry=1, node=node@entry=0x0) at
/build/php7.0-VhrlDZ/php7.0-7.0.14/ext/soap/soap.c:3829
#3 0x00007f372d4f734a in serialize_response_call (function=function@entry=0x7f37306af080,
function_name=function_name@entry=0x7f37306b1450 "pollResponse", uri=0x7f373065d120
"http://www.ipcom.at/RcodeZero/SecondaryDNS",
ret=ret@entry=0x7ffc1a0e3f10, headers=<optimized out>, version=version@entry=1)
at /build/php7.0-VhrlDZ/php7.0-7.0.14/ext/soap/soap.c:4189
#4 0x00007f372d50261b in zim_SoapServer_handle (execute_data=<optimized out>,
return_value=<optimized out>)
at /build/php7.0-VhrlDZ/php7.0-7.0.14/ext/soap/soap.c:1915
#5 0x00007f37371ca44b in ?? () from /usr/lib/apache2/modules/libphp7.0.so
#6 0x00007f373718c59b in execute_ex () from /usr/lib/apache2/modules/libphp7.0.so
#7 0x00007f37371d5e0f in zend_execute () from /usr/lib/apache2/modules/libphp7.0.so
#8 0x00007f373714ffc4 in zend_execute_scripts () from /usr/lib/apache2/modules/libphp7.0.so
#9 0x00007f37370f2fd8 in php_execute_script () from /usr/lib/apache2/modules/libphp7.0.so
#10 0x00007f37371d7752 in ?? () from /usr/lib/apache2/modules/libphp7.0.so
#11 0x00007f373b5353f0 in ap_run_handler ()
#12 0x00007f373b535939 in ap_invoke_handler ()
#13 0x00007f373b54cd4a in ap_process_async_request ()
#14 0x00007f373b54d024 in ap_process_request ()
#15 0x00007f373b549005 in ?? ()
#16 0x00007f373b53f230 in ap_run_process_connection ()
#17 0x00007f373772aa20 in ?? () from /usr/lib/apache2/modules/mod_mpm_prefork.so
#18 0x00007f373772acb2 in ?? () from /usr/lib/apache2/modules/mod_mpm_prefork.so
#19 0x00007f373772ad1f in ?? () from /usr/lib/apache2/modules/mod_mpm_prefork.so
#20 0x00007f373772bbff in ?? () from /usr/lib/apache2/modules/mod_mpm_prefork.so
#21 0x00007f373b517f7e in ap_run_mpm ()
#22 0x00007f373b510ac8 in main ()
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=73906&edit=1