Skip to content

Commit 51149b6

Browse files
nielsdosnielsdos
committed
Merge branch 'PHP-8.4'
* PHP-8.4: Fix GH-18990, bug #81029, bug #47314: SOAP HTTP socket not closing on object destruction Fix leak when path is too long in ZipArchive::extractTo() curl: Remove incorrect string release on error
2 parents 1a4dfd5 + 764154d commit 51149b6

File tree

4 files changed

+68
-12
lines changed

4 files changed

+68
-12
lines changed

‎ext/curl/interface.c

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1412,7 +1412,6 @@ static inline CURLcode add_simple_field(curl_mime *mime, zend_string *string_key
14121412
part = curl_mime_addpart(mime);
14131413
if (part == NULL) {
14141414
zend_tmp_string_release(tmp_postval);
1415-
zend_string_release_ex(string_key, 0);
14161415
return CURLE_OUT_OF_MEMORY;
14171416
}
14181417
if ((form_error = curl_mime_name(part, ZSTR_VAL(string_key))) != CURLE_OK

‎ext/soap/php_http.c

Lines changed: 9 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -506,9 +506,9 @@ int make_http_soap_request(zval *this_ptr,
506506
zend_string_equals(orig->host, phpurl->host) &&
507507
orig->port == phpurl->port))) {
508508
} else {
509+
ZVAL_NULL(Z_CLIENT_HTTPSOCKET_P(this_ptr));
509510
php_stream_close(stream);
510511
convert_to_null(Z_CLIENT_HTTPURL_P(this_ptr));
511-
convert_to_null(Z_CLIENT_HTTPSOCKET_P(this_ptr));
512512
convert_to_null(Z_CLIENT_USE_PROXY_P(this_ptr));
513513
stream = NULL;
514514
use_proxy = 0;
@@ -517,9 +517,9 @@ int make_http_soap_request(zval *this_ptr,
517517

518518
/* Check if keep-alive connection is still opened */
519519
if (stream != NULL && php_stream_eof(stream)) {
520+
ZVAL_NULL(Z_CLIENT_HTTPSOCKET_P(this_ptr));
520521
php_stream_close(stream);
521522
convert_to_null(Z_CLIENT_HTTPURL_P(this_ptr));
522-
convert_to_null(Z_CLIENT_HTTPSOCKET_P(this_ptr));
523523
convert_to_null(Z_CLIENT_USE_PROXY_P(this_ptr));
524524
stream = NULL;
525525
use_proxy = 0;
@@ -528,9 +528,7 @@ int make_http_soap_request(zval *this_ptr,
528528
if (!stream) {
529529
stream = http_connect(this_ptr, phpurl, use_ssl, context, &use_proxy);
530530
if (stream) {
531-
php_stream_auto_cleanup(stream);
532-
ZVAL_RES(Z_CLIENT_HTTPSOCKET_P(this_ptr), stream->res);
533-
GC_ADDREF(stream->res);
531+
php_stream_to_zval(stream, Z_CLIENT_HTTPSOCKET_P(this_ptr));
534532
ZVAL_LONG(Z_CLIENT_USE_PROXY_P(this_ptr), use_proxy);
535533
} else {
536534
php_url_free(phpurl);
@@ -686,9 +684,9 @@ int make_http_soap_request(zval *this_ptr,
686684

687685
if (UNEXPECTED(php_random_bytes_throw(&nonce, sizeof(nonce)) != SUCCESS)) {
688686
ZEND_ASSERT(EG(exception));
687+
ZVAL_NULL(Z_CLIENT_HTTPSOCKET_P(this_ptr));
689688
php_stream_close(stream);
690689
convert_to_null(Z_CLIENT_HTTPURL_P(this_ptr));
691-
convert_to_null(Z_CLIENT_HTTPSOCKET_P(this_ptr));
692690
convert_to_null(Z_CLIENT_USE_PROXY_P(this_ptr));
693691
smart_str_free(&soap_headers_z);
694692
smart_str_free(&soap_headers);
@@ -904,9 +902,9 @@ int make_http_soap_request(zval *this_ptr,
904902
if (request != buf) {
905903
zend_string_release_ex(request, 0);
906904
}
905+
ZVAL_NULL(Z_CLIENT_HTTPSOCKET_P(this_ptr));
907906
php_stream_close(stream);
908907
convert_to_null(Z_CLIENT_HTTPURL_P(this_ptr));
909-
convert_to_null(Z_CLIENT_HTTPSOCKET_P(this_ptr));
910908
convert_to_null(Z_CLIENT_USE_PROXY_P(this_ptr));
911909
add_soap_fault(this_ptr, "HTTP", "Failed Sending HTTP SOAP request", NULL, NULL, SOAP_GLOBAL(lang_en));
912910
smart_str_free(&soap_headers_z);
@@ -929,8 +927,8 @@ int make_http_soap_request(zval *this_ptr,
929927
if (request != buf) {
930928
zend_string_release_ex(request, 0);
931929
}
930+
ZVAL_NULL(Z_CLIENT_HTTPSOCKET_P(this_ptr));
932931
php_stream_close(stream);
933-
convert_to_null(Z_CLIENT_HTTPSOCKET_P(this_ptr));
934932
convert_to_null(Z_CLIENT_USE_PROXY_P(this_ptr));
935933
add_soap_fault(this_ptr, "HTTP", "Error Fetching http headers", NULL, NULL, SOAP_GLOBAL(lang_en));
936934
smart_str_free(&soap_headers_z);
@@ -982,11 +980,11 @@ int make_http_soap_request(zval *this_ptr,
982980
if (request != buf) {
983981
zend_string_release_ex(request, 0);
984982
}
983+
ZVAL_NULL(Z_CLIENT_HTTPSOCKET_P(this_ptr));
985984
php_stream_close(stream);
986985
if (http_headers) {
987986
zend_string_release_ex(http_headers, 0);
988987
}
989-
convert_to_null(Z_CLIENT_HTTPSOCKET_P(this_ptr));
990988
convert_to_null(Z_CLIENT_USE_PROXY_P(this_ptr));
991989
if (http_msg) {
992990
efree(http_msg);
@@ -1117,9 +1115,9 @@ int make_http_soap_request(zval *this_ptr,
11171115
if (request != buf) {
11181116
zend_string_release_ex(request, 0);
11191117
}
1118+
ZVAL_NULL(Z_CLIENT_HTTPSOCKET_P(this_ptr));
11201119
php_stream_close(stream);
11211120
zend_string_release_ex(http_headers, 0);
1122-
convert_to_null(Z_CLIENT_HTTPSOCKET_P(this_ptr));
11231121
convert_to_null(Z_CLIENT_USE_PROXY_P(this_ptr));
11241122
add_soap_fault(this_ptr, "HTTP", "Error Fetching http body, No Content-Length, connection closed or chunked data", NULL, NULL, SOAP_GLOBAL(lang_en));
11251123
if (http_msg) {
@@ -1134,8 +1132,8 @@ int make_http_soap_request(zval *this_ptr,
11341132
}
11351133

11361134
if (http_close) {
1135+
ZVAL_NULL(Z_CLIENT_HTTPSOCKET_P(this_ptr));
11371136
php_stream_close(stream);
1138-
convert_to_null(Z_CLIENT_HTTPSOCKET_P(this_ptr));
11391137
convert_to_null(Z_CLIENT_USE_PROXY_P(this_ptr));
11401138
stream = NULL;
11411139
}

‎ext/soap/tests/bugs/gh18990.phpt

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
--TEST--
2+
GH-18990 (SOAP HTTP socket not closing on object destruction)
3+
--INI--
4+
soap.wsdl_cache_enabled=0
5+
--EXTENSIONS--
6+
soap
7+
--SKIPIF--
8+
<?php
9+
require __DIR__.'/../../../standard/tests/http/server.inc';
10+
http_server_skipif();
11+
--FILE--
12+
<?php
13+
require __DIR__.'/../../../standard/tests/http/server.inc';
14+
15+
$wsdl = file_get_contents(__DIR__.'/../server030.wsdl');
16+
17+
$soap = <<<EOF
18+
<?xml version="1.0" encoding="UTF-8"?>
19+
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="http://testuri.org" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><ns1:getItemsResponse><getItemsReturn SOAP-ENC:arrayType="ns1:Item[10]" xsi:type="ns1:ItemArray"><item xsi:type="ns1:Item"><text xsi:type="xsd:string">text0</text></item><item xsi:type="ns1:Item"><text xsi:type="xsd:string">text1</text></item><item xsi:type="ns1:Item"><text xsi:type="xsd:string">text2</text></item><item xsi:type="ns1:Item"><text xsi:type="xsd:string">text3</text></item><item xsi:type="ns1:Item"><text xsi:type="xsd:string">text4</text></item><item xsi:type="ns1:Item"><text xsi:type="xsd:string">text5</text></item><item xsi:type="ns1:Item"><text xsi:type="xsd:string">text6</text></item><item xsi:type="ns1:Item"><text xsi:type="xsd:string">text7</text></item><item xsi:type="ns1:Item"><text xsi:type="xsd:string">text8</text></item><item xsi:type="ns1:Item"><text xsi:type="xsd:string">text9</text></item></getItemsReturn></ns1:getItemsResponse></SOAP-ENV:Body></SOAP-ENV:Envelope>
20+
EOF;
21+
22+
$responses = [
23+
"data://text/plain,HTTP/1.1 200 OK\r\n".
24+
"Content-Type: text/xml;charset=utf-8\r\n".
25+
"Connection: Keep-Alive\r\n".
26+
"Content-Length: ".strlen($wsdl)."\r\n".
27+
"\r\n".
28+
$wsdl,
29+
30+
"data://text/plain,HTTP/1.1 200 OK\r\n".
31+
"Content-Type: text/xml;charset=utf-8\r\n".
32+
"Connection: Keep-Alive\r\n".
33+
"Content-Length: ".strlen($soap)."\r\n".
34+
"\r\n".
35+
$soap,
36+
];
37+
38+
['pid' => $pid, 'uri' => $uri] = http_server($responses);
39+
40+
$options = [
41+
'trace' => false,
42+
'location' => $uri,
43+
];
44+
45+
$cnt = count(get_resources());
46+
47+
$client = new SoapClient($uri, $options);
48+
49+
var_dump(count($client->getItems()));
50+
51+
http_server_kill($pid);
52+
53+
unset($client);
54+
var_dump(count(get_resources()) - $cnt);
55+
?>
56+
--EXPECT--
57+
int(10)
58+
int(0)

‎ext/zip/php_zip.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -211,6 +211,7 @@ static int php_zip_extract_file(struct zip * za, char *dest, const char *file, s
211211
return 0;
212212
} else if (len > MAXPATHLEN) {
213213
php_error_docref(NULL, E_WARNING, "Full extraction path exceed MAXPATHLEN (%i)", MAXPATHLEN);
214+
efree(fullpath);
214215
efree(file_dirname_fullpath);
215216
zend_string_release_ex(file_basename, 0);
216217
CWD_STATE_FREE(new_state.cwd);

0 commit comments

Comments
 (0)