Bug #77141 [NEW]: Integer overflow on SOAP request or response with -1 precision ini setting
From: lukasz dot jedrzejowski at adition dot com
Operating system: Debian GNU/Linux 9.5 (stretch)
PHP version: 7.1.24
Package: SOAP related
Bug Type: Bug
Bug description:Integer overflow on SOAP request or response with -1 precision ini setting
Description:
------------
Reproduced in:
- 7.1.23-2+0~20181015120514.8+stretch~1.gbpab65a0 (used this one as the
nearest reported affected version).
- 7.2.10-0ubuntu0.18.04.1
- 7.2.11-4+0~20181106031630.10+stretch~1.gbp789850
but worked correctly in:
- 5.6.24-0+deb8u1
Using -1 "precision" ini-setting on either SOAP request or response when
passing a float results in a fatal error: "Possible integer overflow in
memory allocation".
Using other precision settings affects the string representation of
passed floats as expected.
Although I've tested it manually on the SoapServer too, I'm providing
the easier client side steps to reproduce.
Test script was executed by running /tmp/test.php in cli mode.
Test script:
---------------
$soap = new \SoapClient(
null,
array(
'location' => "http://localhost/soap.php",
'uri' => "http://localhost/",
'style' => SOAP_RPC,
'trace' => true,
'exceptions' => true,
)
);
ini_set('precision', -1);
try {
$soap->call(1.1);
} finally {
echo $soap->__getLastRequest();
}
Expected result:
----------------
Expected to see the traced SOAP request with float represented as string
according to the set precision (for -1 precision the float 1.1 should be
represented as "1.1").
Please ignore the additional "DTD are not supported" fatal error because
of not actually running a SoapServer under the given URI.
SOAP response output was shortened to avoid "spam detection" triggered
by long lines when reporting this bug.
...<SOAP-ENV:Body><ns1:call><param0
xsi:type="xsd:float">1.1</param0></ns1:call></SOAP-ENV:Body>...
PHP Fatal error: Uncaught SoapFault exception: [Client] DTD are not
supported by SOAP in /tmp/test.php:14
Stack trace:
#0 /tmp/test.php(14): SoapClient->__call('call', Array)
#1 /tmp/test.php(14): SoapClient->call(1.1)
#2 {main}
thrown in /tmp/test.php on line 14
Actual result:
--------------
PHP Fatal error: Uncaught SoapFault exception: [Client] Possible
integer overflow in memory allocation (18446744073709551615 * 1 + 33) in
/tmp/test.php:13
Stack trace:
#0 /tmp/test.php(13): SoapClient->__call('call', Array)
#1 {main}
thrown in /tmp/test.php on line 13
--
Edit bug report at https://bugs.php.net/bug.php?id=77141&edit=1
--
Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=77141&r=trysnapshot54
Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=77141&r=trysnapshot55
Try a snapshot (trunk): https://bugs.php.net/fix.php?id=77141&r=trysnapshottrunk
Fixed in SVN: https://bugs.php.net/fix.php?id=77141&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=77141&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=77141&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=77141&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=77141&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=77141&r=support
Expected behavior: https://bugs.php.net/fix.php?id=77141&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=77141&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=77141&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=77141&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=77141&r=php4
Daylight Savings: https://bugs.php.net/fix.php?id=77141&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=77141&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=77141&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=77141&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=77141&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=77141&r=mysqlcfg
Thread (3 messages)
- lukasz dot jedrzejowski at adition dot com