Skip to content

Fix GH-25303: NULL encoder dereference in to_xml_list() error message - #25316

Closed
lazerg wants to merge 2 commits into
php:PHP-8.6from
lazerg:fix/gh-25303
Closed

lazerg wants to merge 2 commits into
php:PHP-8.6from
lazerg:fix/gh-25303

Conversation

@lazerg

@lazerg lazerg commented Nov 8, 2026

Copy link
Copy Markdown
Contributor

A union type (and a list without an item type) leaves list_enc NULL in to_xml_list(). When an item fails to encode, the new error message from #22706 reads list_enc->details and dereferences NULL. It now passes NULL to soap_type_name() in that case, which already prints "unknown".

Fixes #25303

Comment thread ext/soap/php_encoding.c
@@ -3117,7 +3117,7 @@ static xmlNodePtr to_xml_list(encodeTypePtr enc, zval *data, int style, xmlNodeP
} else {

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

--- a/ext/soap/php_encoding.c
+++ b/ext/soap/php_encoding.c
@@ -3080,6 +3080,17 @@ static zval* to_zval_list(zval *ret, encodeTypePtr enc, xmlNodePtr data) {
        return to_zval_stringc(ret, enc, data);
 }

+static void to_xml_list_item_error(encodeTypePtr enc, encodePtr list_enc)
+{
+       if (enc->sdl_type && enc->sdl_type->kind == XSD_TYPEKIND_UNION) {
+               soap_error1(E_ERROR, "Encoding: Value does not match any member type of union type '%s'",
+                       soap_type_name(enc));
+       } else {
+               soap_error2(E_ERROR, "Encoding: Failed to encode list item of type '%s' for list type '%s'",
+                       soap_type_name(list_enc ? &list_enc->details : NULL), soap_type_name(enc));
+       }
+}
+
 static xmlNodePtr to_xml_list(encodeTypePtr enc, zval *data, int style, xmlNodePtr parent) {
        xmlNodePtr ret;
        encodePtr list_enc = NULL;
@@ -3115,9 +3126,7 @@ static xmlNodePtr to_xml_list(encodeTypePtr enc, zval *data, int style, xmlNodeP
                                }
                                smart_str_appends(&list, (char*)dummy->children->content);
                        } else {
-                               soap_error2(E_ERROR,
-                                       "Encoding: Failed to encode list item of type '%s' for list type '%s'",
-                                       soap_type_name(&list_enc->details), soap_type_name(enc));
+                               to_xml_list_item_error(enc, list_enc);
                        }
                        xmlUnlinkNode(dummy);
                        xmlFreeNode(dummy);
@@ -3159,9 +3168,7 @@ static xmlNodePtr to_xml_list(encodeTypePtr enc, zval *data, int style, xmlNodeP
                                }
                                smart_str_appends(&list, (char*)dummy->children->content);
                        } else {
-                               soap_error2(E_ERROR,
-                                       "Encoding: Failed to encode st type '%s'",
-                                       soap_type_name(&list_enc->details), soap_type_name(enc));
+                               to_xml_list_item_error(enc, list_enc
                        }
                        xmlUnlinkNode(dummy);
                        xmlFreeNode(dummy);

@lazerg

lazerg commented Nov 9, 2026

Copy link
Copy Markdown
Contributor Author

Applied your suggestion in 96183be, the union case now gets its own message and the test expects it.

@devnexen devnexen closed this in 18ece89 Nov 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants