Fixed bug #40609 (Segfaults when using more than one SoapVar in a request). (Rob, Dmitry)

NEWS

@@ -10,6 +10,8 @@ PHP                                                                        NEWS
 - Added tidyNode::getParent() method (John, Nuno)
 - Fixed zend_llist_remove_tail (Michael Wallner, Dmitry)
 - Fixed bug #40621 (Crash when constructor called inappropriately). (Tony)
+- Fixed bug #40609 (Segfaults when using more than one SoapVar in a request).
+  (Rob, Dmitry)
 - Fixed bug #40606 (umask is not being restored when request is finished). 
   (Tony)
 - Fixed bug #40598 (libxml segfault). (Rob)

ext/soap/php_encoding.c

@@ -2888,8 +2888,18 @@ static xmlNodePtr to_xml_any(encodeTypePtr type, zval *data, int style, xmlNodeP
 		ret = xmlNewTextLen(BAD_CAST(Z_STRVAL(tmp)), Z_STRLEN(tmp));
 		zval_dtor(&tmp);
 	}
+
 	ret->name = xmlStringTextNoenc;
-	xmlAddChild(parent, ret);
+	ret->parent = parent;
+	ret->doc = parent->doc;
+	ret->prev = parent->last;
+	ret->next = NULL;
+	if (parent->last) {
+		parent->last->next = ret;
+	} else {
+		parent->children = ret;
+	}
+	parent->last = ret;
 
 	return ret;
 }

ext/soap/tests/bugs/bug40609.phpt

@@ -0,0 +1,21 @@
+--TEST--
+Bug #40609 (Segfaults when using more than one SoapVar in a request)
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--INI--
+soap.wsdl_cache_enabled=0
+--FILE--
+<?php
+ini_set("soap.wsdl_cache_enabled", 0);
+
+$c = new SoapClient(dirname(__FILE__)."/bug40609.wsdl", array('trace' => 1,' exceptions' => 0));
+
+$c->update(array('symbol' => new SoapVar("<symbol>MSFT</symbol>", XSD_ANYXML),
+                 'price' =>  new SoapVar("<price>1000</price>", XSD_ANYXML)));
+echo $c->__getLastRequest();
+echo "ok\n";
+?>
+--EXPECT--
+<?xml version="1.0" encoding="UTF-8"?>
+<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="http://quickstart.samples/xsd"><SOAP-ENV:Body><ns1:update><symbol>MSFT</symbol><price>1000</price></ns1:update></SOAP-ENV:Body></SOAP-ENV:Envelope>
+ok

ext/soap/tests/bugs/bug40609.wsdl

@@ -0,0 +1,26 @@
+<wsdl:definitions xmlns:axis2="http://quickstart.samples/" xmlns:http="http://schemas.xmlsoap.org/wsdl/http/" xmlns:mime="http://schemas.xmlsoap.org/wsdl/mime/" xmlns:soap12="http://schemas.xmlsoap.org/wsdl/soap12/" xmlns:ns="http://quickstart.samples/xsd" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/" targetNamespace="http://quickstart.samples/"><wsdl:documentation>
+        Stock Quote Service
+    </wsdl:documentation><wsdl:types><xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" attributeFormDefault="qualified" elementFormDefault="qualified" targetNamespace="http://quickstart.samples/xsd">
+<xs:element name="getPrice">
+<xs:complexType>
+<xs:sequence>
+<xs:element name="symbol" nillable="true" type="xs:string" />
+</xs:sequence>
+</xs:complexType>
+</xs:element>
+<xs:element name="getPriceResponse">
+<xs:complexType>
+<xs:sequence>
+<xs:element name="return" nillable="true" type="xs:double" />
+</xs:sequence>
+</xs:complexType>
+</xs:element>
+<xs:element name="update">
+<xs:complexType>
+<xs:sequence>
+<xs:element name="symbol" nillable="true" type="xs:any" />
+<xs:element name="price" nillable="true" type="xs:any" />
+</xs:sequence>
+</xs:complexType>
+</xs:element>
+</xs:schema></wsdl:types><wsdl:message name="updateMessage"><wsdl:part name="part1" element="ns:update" /></wsdl:message><wsdl:message name="getPriceMessage"><wsdl:part name="part1" element="ns:getPrice" /></wsdl:message><wsdl:message name="getPriceResponseMessage"><wsdl:part name="part1" element="ns:getPriceResponse" /></wsdl:message><wsdl:portType name="StockQuoteServicePortType"><wsdl:operation name="update"><wsdl:input xmlns:wsaw="http://www.w3.org/2006/05/addressing/wsdl" message="axis2:updateMessage" wsaw:Action="urn:update" /></wsdl:operation><wsdl:operation name="getPrice"><wsdl:input xmlns:wsaw="http://www.w3.org/2006/05/addressing/wsdl" message="axis2:getPriceMessage" wsaw:Action="urn:getPrice" /><wsdl:output xmlns:wsaw="http://www.w3.org/2006/05/addressing/wsdl" message="axis2:getPriceResponseMessage" wsaw:Action="http://quickstart.samples/StockQuoteServicePortType/getPriceResponse" /></wsdl:operation></wsdl:portType><wsdl:binding name="StockQuoteServiceSOAP11Binding" type="axis2:StockQuoteServicePortType"><soap:binding transport="http://schemas.xmlsoap.org/soap/http" style="document" /><wsdl:operation name="update"><soap:operation soapAction="urn:update" style="document" /><wsdl:input><soap:body use="literal" /></wsdl:input></wsdl:operation><wsdl:operation name="getPrice"><soap:operation soapAction="urn:getPrice" style="document" /><wsdl:input><soap:body use="literal" /></wsdl:input><wsdl:output><soap:body use="literal" /></wsdl:output></wsdl:operation></wsdl:binding><wsdl:binding name="StockQuoteServiceSOAP12Binding" type="axis2:StockQuoteServicePortType"><soap12:binding transport="http://schemas.xmlsoap.org/soap/http" style="document" /><wsdl:operation name="update"><soap12:operation soapAction="urn:update" style="document" /><wsdl:input><soap12:body use="literal" /></wsdl:input></wsdl:operation><wsdl:operation name="getPrice"><soap12:operation soapAction="urn:getPrice" style="document" /><wsdl:input><soap12:body use="literal" /></wsdl:input><wsdl:output><soap12:body use="literal" /></wsdl:output></wsdl:operation></wsdl:binding><wsdl:binding name="StockQuoteServiceHttpBinding" type="axis2:StockQuoteServicePortType"><http:binding verb="POST" /><wsdl:operation name="update"><http:operation location="update" /><wsdl:input><mime:content type="text/xml" /></wsdl:input></wsdl:operation><wsdl:operation name="getPrice"><http:operation location="getPrice" /><wsdl:input><mime:content type="text/xml" /></wsdl:input><wsdl:output><mime:content type="text/xml" /></wsdl:output></wsdl:operation></wsdl:binding><wsdl:service name="StockQuoteService"><wsdl:port name="StockQuoteServiceSOAP11port_http" binding="axis2:StockQuoteServiceSOAP11Binding"><soap:address location="http://bluelines.org:8080/axis2/services/StockQuoteService" /></wsdl:port><wsdl:port name="StockQuoteServiceSOAP12port_http" binding="axis2:StockQuoteServiceSOAP12Binding"><soap12:address location="http://bluelines.org:8080/axis2/services/StockQuoteService" /></wsdl:port><wsdl:port name="StockQuoteServiceHttpport1" binding="axis2:StockQuoteServiceHttpBinding"><http:address location="test://" /></wsdl:port></wsdl:service></wsdl:definitions>