From 809a58bc1bc93b7db94a14080dcf3233b013fc0a Mon Sep 17 00:00:00 2001 From: Niels Dossche <7771979+nielsdos@users.noreply.github.com> Date: Sat, 5 Oct 2024 12:40:08 +0200 Subject: [PATCH] Fix GH-16237: Segmentation fault when cloning SoapServer Bisect points to 94ee4f9, however this only reveals the problem. Cloning an object on a lower branch and trying to call its methods crashes as well. Cloning the object shouldn't be possible in the first place because there's an engine constraint that when we have a new object handler we should also have a clone handler. This constraint is not fulfilled here. Closes GH-16245. --- NEWS | 1 + ext/soap/soap.c | 1 + ext/soap/tests/bugs/gh16237.phpt | 17 +++++++++++++++++ 3 files changed, 19 insertions(+) create mode 100644 ext/soap/tests/bugs/gh16237.phpt diff --git a/NEWS b/NEWS index cfd3912bbbe..7fcbacc037e 100644 --- a/NEWS +++ b/NEWS @@ -70,6 +70,7 @@ PHP NEWS - SOAP: . Fixed bug #62900 (Wrong namespace on xsd import error message). (nielsdos) + . Fixed bug GH-16237 (Segmentation fault when cloning SoapServer). (nielsdos) - Standard: . Fixed bug GH-15613 (overflow on unpack call hex string repeater). diff --git a/ext/soap/soap.c b/ext/soap/soap.c index e98820c630e..924e60deaa4 100644 --- a/ext/soap/soap.c +++ b/ext/soap/soap.c @@ -412,6 +412,7 @@ PHP_MINIT_FUNCTION(soap) memcpy(&soap_server_object_handlers, &std_object_handlers, sizeof(zend_object_handlers)); soap_server_object_handlers.offset = XtOffsetOf(soap_server_object, std); soap_server_object_handlers.free_obj = soap_server_object_free; + soap_server_object_handlers.clone_obj = NULL; /* Register SoapFault class */ soap_fault_class_entry = register_class_SoapFault(zend_ce_exception); diff --git a/ext/soap/tests/bugs/gh16237.phpt b/ext/soap/tests/bugs/gh16237.phpt new file mode 100644 index 00000000000..468f2794399 --- /dev/null +++ b/ext/soap/tests/bugs/gh16237.phpt @@ -0,0 +1,17 @@ +--TEST-- +GH-16237 (Segmentation fault when cloning SoapServer) +--EXTENSIONS-- +soap +--FILE-- +"http://testuri.org"]); +try { + clone $server; +} catch (Error $e) { + echo $e->getMessage(), "\n"; +} + +?> +--EXPECT-- +Trying to clone an uncloneable object of class SoapServer