Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

Null pointer dereference while serializing the response #9720

Closed
@istoph

Description

@istoph

Description

The following code:

<?phpclass soapService{function__construct() {  }functionopenSession($user) {return ["OK","200"];//<-- The array leads into the area that leads to the error.  }}$sc =newSoapServer(__dir__ .'/service.wsdl');$sc->setClass("soapService");$sc->handle();

with thisservice.wsdl file:

<?xml version="1.0" encoding="utf-8"?><definitionsname="soapService"targetNamespace="urn:soapService"xmlns:typens="urn:soapService"xmlns:xsd="http://www.w3.org/2001/XMLSchema"xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/"xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/"xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/"xmlns="http://schemas.xmlsoap.org/wsdl/">  <messagename="openSession">    <partname="user"type="xsd:string" />  </message>  <messagename="openSessionResponse">    <partname="status"type="xsd:string" />    <partname="error_code"type="xsd:string" />  </message>  <portTypename="soapServicePortType">    <operationname="openSession">      <documentation>Service Call: openSession</documentation>      <inputmessage="typens:openSession" />      <outputmessage="typens:openSessionResponse" />    </operation>  </portType>  <bindingname="soapServiceBinding"type="typens:soapServicePortType">    <soap:bindingstyle="rpc"transport="http://schemas.xmlsoap.org/soap/http" />    <operationname="openSession">      <soap:operationsoapAction="urn:openSession" />      <input>        <soap:bodynamespace="urn:soapService"use="encoded"encodingStyle="http://schemas.xmlsoap.org/soap/encoding/" />      </input>      <output>        <soap:bodynamespace="urn:soapService"use="encoded"encodingStyle="http://schemas.xmlsoap.org/soap/encoding/" />      </output>    </operation>  </binding>  <servicename="soapServiceService">    <portname="soapServicePort"binding="typens:soapServiceBinding">      <soap:addresslocation="###PHP_SELF###" />    </port>  </service></definitions>

Resulted in this a segfault with gdb output:

Program received signal SIGSEGV, Segmentation fault.0x00007f60ce1f1c75 in __strlen_avx2 () from /lib64/libc.so.6(gdb) bt#0  0x00007f60ce1f1c75 in __strlen_avx2 () from /lib64/libc.so.6#1  0x00007f60c1cdeb6d in get_param (function=function@entry=0x7f60cc2720c0,    param_name=param_name@entry=0x18 <error: Cannot access memory ataddress0x18>, index=<optimized out>, response=response@entry=1)    at /usr/src/debug/php82-php-8.2.0~rc3-16.el8.remi.x86_64/ext/soap/soap.c:3978#2  0x00007f60c1cdfe54 in serialize_response_call2 (body=body@entry=0x557c1ae411d0, function=function@entry=0x7f60cc2720c0,    function_name=function_name@entry=0x7f60cc256078"openSessionResponse", uri=uri@entry=0x7f60cc2660c0"urn:soapService",     ret=ret@entry=0x7ffcc3881630, version=version@entry=1, main=1, node=0x0)    at /usr/src/debug/php82-php-8.2.0~rc3-16.el8.remi.x86_64/ext/soap/soap.c:3292#3  0x00007f60c1ce509b in serialize_response_call (function=0x7f60cc2720c0, function_name=0x7f60cc256078 "openSessionResponse",    uri=0x7f60cc2660c0"urn:soapService", ret=0x7ffcc3881630, headers=0x0, version=1)    at /usr/src/debug/php82-php-8.2.0~rc3-16.el8.remi.x86_64/ext/soap/soap.c:3660#4  0x00007f60c1ced386 in zim_SoapServer_handle (execute_data=0x7f60cc213090, return_value=<optimized out>)    at /usr/src/debug/php82-php-8.2.0~rc3-16.el8.remi.x86_64/ext/soap/soap.c:1484#5  0x00007f60cbcbe4f5 in xdebug_execute_internal () from /opt/remi/php82/root/usr/lib64/php/modules/xdebug.so#6  0x0000557c196a02c8 in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER ()    at /usr/src/debug/php82-php-8.2.0~rc3-16.el8.remi.x86_64/Zend/zend_vm_execute.h:1844#7  execute_ex (ex=0x18) at /usr/src/debug/php82-php-8.2.0~rc3-16.el8.remi.x86_64/Zend/zend_vm_execute.h:56047#8  0x00007f60cbcbda4c in xdebug_execute_ex () from /opt/remi/php82/root/usr/lib64/php/modules/xdebug.so#9  0x0000557c196a1932 in zend_execute (op_array=0x7f60cc280000, return_value=0x0)    at /usr/src/debug/php82-php-8.2.0~rc3-16.el8.remi.x86_64/Zend/zend_vm_execute.h:60379#10 0x0000557c1962ed15 in zend_execute_scripts (type=type@entry=8, retval=retval@entry=0x0, file_count=file_count@entry=3)    at /usr/src/debug/php82-php-8.2.0~rc3-16.el8.remi.x86_64/Zend/zend.c:1780#11 0x0000557c195c849a in php_execute_script (primary_file=<optimized out>) at /usr/src/debug/php82-php-8.2.0~rc3-16.el8.remi.x86_64/main/main.c:2537#12 0x0000557c1946e662 in main (argc=<optimized out>, argv=<optimized out>)    at /usr/src/debug/php82-php-8.2.0~rc3-16.el8.remi.x86_64/sapi/fpm/fpm/fpm_main.c:1891(gdb)frame2#2  0x00007f60c1cdfe54 in serialize_response_call2 (body=body@entry=0x557c1ae411d0, function=function@entry=0x7f60cc2720c0,    function_name=function_name@entry=0x7f60cc256078"openSessionResponse", uri=uri@entry=0x7f60cc2660c0"urn:soapService",     ret=ret@entry=0x7ffcc3881630, version=version@entry=1, main=1, node=0x0)    at /usr/src/debug/php82-php-8.2.0~rc3-16.el8.remi.x86_64/ext/soap/soap.c:32923292parameter = get_param(function, ZSTR_VAL(param_name), param_index, TRUE);(gdb) infolocals _z =0x557c1b8bf740__ht =0x557c1b8bf700__key =0x0_idx =1_count =2__h = <optimized out>_size = <optimized out>__z =0x557c1b8bf750data =0x557c1b8bf740i =0param_name =0x0param_index = <optimized out>method = <optimized out>param = <optimized out>parameter = <optimized out>param_count = <optimized out>style = <optimized out>use = <optimized out>ns = <optimized out>(gdb)frame1#1  0x00007f60c1cdeb6d in get_param (function=function@entry=0x7f60cc2720c0,    param_name=param_name@entry=0x18 <error: Cannot access memory ataddress0x18>, index=<optimized out>, response=response@entry=1)    at /usr/src/debug/php82-php-8.2.0~rc3-16.el8.remi.x86_64/ext/soap/soap.c:39783978if ((tmp = zend_hash_str_find_ptr(ht, param_name, strlen(param_name))) != NULL) {(gdb) infolocals tmp = <optimized out>ht =0x7f60cc260428

In frame 2 the varparam_name is from typezend_string but in frame 1 achar* is expected. The type conflict leads to0x18 not being recognized asnull in the if statement before.

But I expected this output instead:

<?xml version="1.0" encoding="UTF-8"?><SOAP-ENV:Envelopexmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"xmlns:ns1="urn:soapService"xmlns:xsd="http://www.w3.org/2001/XMLSchema"xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/"SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><ns1:openSessionResponse><statusxsi:type="xsd:string">OK</status><error_codexsi:type="xsd:string">200</error_code></ns1:openSessionResponse></SOAP-ENV:Body></SOAP-ENV:Envelope>

After we call it with:

curl -L --request POST --data'<?xml version="1.0" encoding="UTF-8"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="urn:soapService" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/s<SOAP-ENV:Body><ns1:openSession><user xsi:type="xsd:string">istoph</user></ns1:openSession></SOAP-ENV:Body></SOAP-ENV:Envelope>' http://localhost:8080/soap/ -H"Content-Type: text/xml; charset=UTF-8"

In version PHP 5.6.32 this example still works. Between PHP 7.0 and 8.2 we could see the failure.

PHP Version

PHP 8.2.0

Operating System

Rhel 8

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions


    [8]ページ先頭

    ©2009-2025 Movatter.jp