diff --git a/NEWS b/NEWS index 427f953259b..d743b3d4fb2 100644 --- a/NEWS +++ b/NEWS @@ -5,6 +5,10 @@ PHP NEWS - MySQLnd: . Fixed potential heap corruption due to alignment mismatch. (cmb) +- SOAP: + . Fixed GH-9720 (Null pointer dereference while serializing the response). + (cmb) + 27 Oct 2022, PHP 8.1.12 - Core: diff --git a/ext/soap/soap.c b/ext/soap/soap.c index d5731a5c9bf..fbf6546beb8 100644 --- a/ext/soap/soap.c +++ b/ext/soap/soap.c @@ -3360,11 +3360,11 @@ static int serialize_response_call2(xmlNodePtr body, sdlFunctionPtr function, ch zend_ulong param_index = i; ZEND_HASH_FOREACH_KEY_VAL(Z_ARRVAL_P(ret), param_index, param_name, data) { - parameter = get_param(function, ZSTR_VAL(param_name), param_index, TRUE); + parameter = get_param(function, param_name ? ZSTR_VAL(param_name) : NULL, param_index, TRUE); if (style == SOAP_RPC) { - param = serialize_parameter(parameter, data, i, ZSTR_VAL(param_name), use, method); + param = serialize_parameter(parameter, data, i, param_name ? ZSTR_VAL(param_name) : NULL, use, method); } else { - param = serialize_parameter(parameter, data, i, ZSTR_VAL(param_name), use, body); + param = serialize_parameter(parameter, data, i, param_name ? ZSTR_VAL(param_name) : NULL, use, body); if (function && function->binding->bindingType == BINDING_SOAP) { if (parameter && parameter->element) { ns = encode_add_ns(param, parameter->element->namens); diff --git a/ext/soap/tests/gh9720.phpt b/ext/soap/tests/gh9720.phpt new file mode 100644 index 00000000000..a9cf67a74b4 --- /dev/null +++ b/ext/soap/tests/gh9720.phpt @@ -0,0 +1,34 @@ +--TEST-- +Bug GH-9720 (Null pointer dereference while serializing the response) +--EXTENSIONS-- +soap +--FILE-- +setClass(SoapService::class); +$request = << + + + + istoph + + + +XML; + +$server->handle($request); +?> +--EXPECT-- + +OK200 diff --git a/ext/soap/tests/gh9720.wsdl b/ext/soap/tests/gh9720.wsdl new file mode 100644 index 00000000000..51780836e0a --- /dev/null +++ b/ext/soap/tests/gh9720.wsdl @@ -0,0 +1,34 @@ + + + + + + + + + + + + Service Call: openSession + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file