diff --git a/ext/soap/php_encoding.c b/ext/soap/php_encoding.c index ae5385b0a95..57f92fa9a72 100644 --- a/ext/soap/php_encoding.c +++ b/ext/soap/php_encoding.c @@ -2268,8 +2268,8 @@ static xmlNodePtr to_xml_array(encodeTypePtr type, zval *data, int style, xmlNod iter = ce->get_iterator(ce, data, 0); - if (EG(exception)) { - goto iterator_done; + if (!iter) { + goto iterator_failed_to_get; } if (iter->funcs->rewind) { @@ -2309,6 +2309,7 @@ static xmlNodePtr to_xml_array(encodeTypePtr type, zval *data, int style, xmlNod } iterator_done: OBJ_RELEASE(&iter->std); +iterator_failed_to_get: if (EG(exception)) { zval_ptr_dtor(&array_copy); ZVAL_UNDEF(&array_copy); diff --git a/ext/soap/tests/bugs/gh16429.phpt b/ext/soap/tests/bugs/gh16429.phpt new file mode 100644 index 00000000000..24d517f96b9 --- /dev/null +++ b/ext/soap/tests/bugs/gh16429.phpt @@ -0,0 +1,22 @@ +--TEST-- +GH-16429 (Segmentation fault (access null pointer) in SoapClient) +--EXTENSIONS-- +soap +--FILE-- +send(10); +$fusion = $gen; +$client = new SoapClient(__DIR__."/../interop/Round2/GroupB/round2_groupB.wsdl",array("trace"=>1,"exceptions"=>0)); +try { + $client->echo2DStringArray($fusion); +} catch (Exception $e) { + echo $e->getMessage(), "\n"; +} +?> +--EXPECT-- +string(10) "xxxxxxxxxx" +Cannot traverse an already closed generator