Skip to content

Fix GH-25267: NULL dereference in to_xml_any() with integer key - #25270

Closed
lazerg wants to merge 1 commit into
php:PHP-8.4from
lazerg:fix/gh-25267-soap-any-int-key
Closed

lazerg wants to merge 1 commit into
php:PHP-8.4from
lazerg:fix/gh-25267-soap-any-int-key

Conversation

@lazerg

@lazerg lazerg commented Nov 7, 2026 •

Copy link
Copy Markdown
Contributor

to_xml_any() renames each node after its array key, but an integer key gives a NULL zend_string and ZSTR_VAL() crashes on it. Now it only renames for string keys, the same way to_xml_object() handles them, so an integer-keyed element keeps its default name.

Fixes #25267

Comment thread ext/soap/tests/gh25267.phpt Outdated
}
}
$c = new C(null, ["location" => "test://", "uri" => "test://"]);
$c->foo(new SoapVar(["a" => new SoapVar("x", XSD_STRING), new SoapVar("y", XSD_STRING)], XSD_ANYXML));

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

With the integer key last, the caller renames the returned node to param0, so the test doesn't show what an integer-keyed element becomes. Putting it first ([new SoapVar("y", XSD_STRING), "a" => ...]) pins the <BOGUS> name it actually gets.

@lazerg lazerg Nov 7, 2026 •

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done in e5ff8d3, the integer-keyed element now comes first and the test expects <BOGUS>.

@iliaal iliaal left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for making the change

to_xml_any() renamed each output node after its array key, but an integer
key has no zend_string, so ZSTR_VAL() dereferenced NULL. Rename only for
string keys, as to_xml_object() does, so an integer-keyed element keeps its
default name.

Fixes phpGH-25267
Closes phpGH-25270
@iliaal
iliaal force-pushed the fix/gh-25267-soap-any-int-key branch from e5ff8d3 to 11f3ded Compare November 7, 2026 17:02
@iliaal iliaal closed this in 1ba316a Nov 7, 2026
@ndossche

ndossche commented Nov 7, 2026

Copy link
Copy Markdown
Member

This fixes the crash, but is this semantically correct though? We now have a BOGUS element in the resulting XML. Does the name "BOGUS" not mean anything anymore ? ;)

@lazerg

lazerg commented Nov 8, 2026

Copy link
Copy Markdown
Contributor Author

Not really, BOGUS is just the placeholder name the encoder gives a node before the caller renames it, and nothing renames it here. It's also what PHP 5.6 did before the string-key check got lost in the PHP 7 port, but since integer keys have crashed ever since, nobody can depend on it, so on master it could just throw for a non-string key instead. I can send that if you think it's better.

@ndossche

ndossche commented Nov 8, 2026

Copy link
Copy Markdown
Member

You should check the soap spec to see what should happen.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants