Fixed bug #75502

The string keys were not duplicated into persistent memory in this case.
php · Jan 1, 2018 · d534d59 · d534d59
1 parent 2fd0b99
commit d534d59
Show file tree

Hide file tree

Showing 3 changed files with 24 additions and 7 deletions.
diff --git a/NEWS b/NEWS
@@ -21,6 +21,7 @@ PHP                                                                        NEWS
 - SOAP:
   . Fixed bug #70469 (SoapClient generates E_ERROR even if exceptions=1 is
     used). (Anton Artamonov)
+  . Fixed bug #75502 (Segmentation fault in zend_string_release). (Nikita)
 
 - SPL:
   . Fixed bug #75717 (RecursiveArrayIterator does not traverse arrays by

diff --git a/ext/soap/php_sdl.c b/ext/soap/php_sdl.c
@@ -2397,12 +2397,6 @@ static void make_persistent_restriction_char_int(sdlRestrictionCharPtr *rest)
 }
 
 
-static void make_persistent_restriction_char(zval *zv)
-{
-	make_persistent_restriction_char_int((sdlRestrictionCharPtr*)&Z_PTR_P(zv));
-}
-
-
 static void make_persistent_sdl_type_ref(sdlTypePtr *type, HashTable *ptr_map, HashTable *bp_types)
 {
 	sdlTypePtr tmp;
@@ -2764,9 +2758,15 @@ static sdlTypePtr make_persistent_sdl_type(sdlTypePtr type, HashTable *ptr_map,
 		}
 
 		if (type->restrictions->enumeration) {
+			sdlRestrictionCharPtr tmp, penum;
 			ptype->restrictions->enumeration = malloc(sizeof(HashTable));
 			zend_hash_init(ptype->restrictions->enumeration, zend_hash_num_elements(type->restrictions->enumeration), NULL, delete_restriction_var_char_persistent, 1);
-			zend_hash_copy(ptype->restrictions->enumeration, type->restrictions->enumeration, make_persistent_restriction_char);
+			ZEND_HASH_FOREACH_STR_KEY_PTR(type->restrictions->enumeration, key, tmp) {
+				penum = tmp;
+				make_persistent_restriction_char_int(&penum);
+				/* We have to duplicate key emalloc->malloc */
+				zend_hash_str_add_ptr(ptype->restrictions->enumeration, ZSTR_VAL(key), ZSTR_LEN(key), penum);
+			} ZEND_HASH_FOREACH_END();
 		}
 	}
 

diff --git a/ext/soap/tests/bugs/bug75502.phpt b/ext/soap/tests/bugs/bug75502.phpt
@@ -0,0 +1,16 @@
+--TEST--
+Bug #75502 (Segmentation fault in zend_string_release)
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--INI--
+soap.wsdl_cache_enabled=1
+soap.wsdl_cache=2
+--FILE--
+<?php
+/* The important part is that restriction>enumeration is used together with mem cache.
+ * Reuse a WSDL file contains this. */
+$client = new SoapClient(dirname(__FILE__)."/bug29236.wsdl");
+?>
+===DONE===
+--EXPECT--
+===DONE===