Skip to content

Fix GH-25094: NULL dereference in SOAP get_doc_function() with missing parts #25101

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
lazerg wants to merge 2 commits into
base: PHP-8.4
Choose a base branch
from
Open

Fix GH-25094: NULL dereference in SOAP get_doc_function() with missing parts #25101

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
04dab60
Fix GH-25094: NULL dereference in SOAP get_doc_function() with missin…
lazerg Oct 31, 2026
9e213bd
Add CREDITS to gh25094.phpt
lazerg Nov 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions ext/soap/soap.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4284,6 +4284,10 @@ static sdlFunctionPtr get_doc_function(sdlPtr sdl, xmlNodePtr params) /* {{{ */
xmlNodePtr node = params;

ZEND_HASH_FOREACH_PTR(tmp->requestParameters, param) {
if (node == NULL) {
ok = 0;
break;
}
if (param->element) {
if (strcmp(param->element->name, (char*)node->name) != 0) {
ok = 0;
Expand Down
29 changes: 29 additions & 0 deletions ext/soap/tests/gh25094.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
--TEST--
GH-25094 (NULL pointer dereference in get_doc_function() when the request has fewer parts than the WSDL)
--CREDITS--
cxxz16
--EXTENSIONS--
soap
--INI--
soap.wsdl_cache_enabled=0

@devnexen devnexen Nov 1, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

credits...

@lazerg lazerg Nov 1, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added cxxz16 under --CREDITS-- in 9e213bd.

--FILE--
<?php
class TestService {
public function Test($a, $b) {
return $a;
}
}

$server = new SoapServer(__DIR__ . '/gh25094.wsdl');
$server->setClass('TestService');

$server->handle(<<<'XML'
<?xml version="1.0"?>
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:tns="http://test-uri">
<SOAP-ENV:Body><tns:a>foo</tns:a></SOAP-ENV:Body>
</SOAP-ENV:Envelope>
XML);
?>
--EXPECT--
<?xml version="1.0" encoding="UTF-8"?>
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"><SOAP-ENV:Body><SOAP-ENV:Fault><faultcode>SOAP-ENV:Server</faultcode><faultstring>Procedure 'a' not present</faultstring></SOAP-ENV:Fault></SOAP-ENV:Body></SOAP-ENV:Envelope>
39 changes: 39 additions & 0 deletions ext/soap/tests/gh25094.wsdl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,39 @@
<?xml version="1.0" encoding="UTF-8"?>
<definitions xmlns="http://schemas.xmlsoap.org/wsdl/"
xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/"
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:tns="http://test-uri"
targetNamespace="http://test-uri">
<types>
<xsd:schema targetNamespace="http://test-uri" elementFormDefault="qualified">
<xsd:element name="a" type="xsd:string"/>
<xsd:element name="b" type="xsd:string"/>
</xsd:schema>
</types>
<message name="TestRequest">
<part name="a" element="tns:a"/>
<part name="b" element="tns:b"/>
</message>
<message name="TestResponse">
<part name="r" element="tns:a"/>
</message>
<portType name="TestPortType">
<operation name="Test">
<input message="tns:TestRequest"/>
<output message="tns:TestResponse"/>
</operation>
</portType>
<binding name="TestBinding" type="tns:TestPortType">
<soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
<operation name="Test">
<soap:operation soapAction="http://test-uri/Test"/>
<input><soap:body use="literal"/></input>
<output><soap:body use="literal"/></output>
</operation>
</binding>
<service name="TestService">
<port name="TestPort" binding="tns:TestBinding">
<soap:address location="http://localhost/test"/>
</port>
</service>
</definitions>
Loading