Array of SoapVar of unknown type causes crash

Description

The following code:

<?php
$v_1030 = 'inputStringArray';
$v_1025 = new SoapVar($v_1030,$v_1025,);
$v_1022 = array(0 => $v_1025,);
$v_1026 = SOAP_ENC_ARRAY;
$v_1027 = 'ArrayOfstring';
$v_1028 = 'http://soapinterop.org/xsd';
$v_1029 = new SoapVar($v_1022,$v_1026,$v_1027,$v_1028,);
$v_1031 = new SoapParam($v_1029,$v_1030,);
$v_1032 = NULL;
$v_1035 = 'test://';
$v_1037 = 'http://soapinterop.org/';
$v_1041 = 0;
$v_1033 = array('location' => $v_1035,'uri' => $v_1037,'trace' => $v_1025,'exceptions' => $v_1041,);
$v_1042 = new SoapClient($v_1032,$v_1033,);
$v_1043 = 'echoStringArray';
$v_1044 = array(0 => $v_1029,);
$v_1047 = 'http://soapinterop.org/';
$v_1045 = array('soapaction' => $v_1047,'uri' => $v_1030,);
$v_1050 = $v_1042->__soapCall($v_1043,$v_1044,$v_1045,);

Resulted in this output:

/home/w023dtc/nightly_php/php-src/ext/soap/php_encoding.c:3674:38: runtime error: null pointer passed as argument 1, which is declared to never be null
/usr/include/string.h:408:33: note: nonnull attribute specified here
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/w023dtc/nightly_php/php-src/ext/soap/php_encoding.c:3674:38

PHP Version

nightly

Operating System

ubuntu 22.04

Reduced to:

<?php
$array = [new SoapVar('inputStringArray', NULL)];
$client = new SoapClient(NULL, ['location' => 'test://', 'uri' => 'http://soapinterop.org/']);
$client->echoStringArray($array);

I think something like this should work (type inference + handling unknown type), but I'm not 100% sure yet:

diff --git a/ext/soap/php_encoding.c b/ext/soap/php_encoding.c
index b9a290fa5ae..29bba8cbf2b 100644
--- a/ext/soap/php_encoding.c
+++ b/ext/soap/php_encoding.c
@@ -3579,6 +3579,9 @@ static encodePtr get_array_type(xmlNodePtr node, zval *array, smart_str *type)
 				soap_error0(E_ERROR,  "Encoding: SoapVar has no 'enc_type' property");
 			}
 			cur_type = Z_LVAL_P(ztype);
+			if (cur_type == UNKNOWN_TYPE) {
+				cur_type = Z_TYPE_P(Z_VAR_ENC_VALUE_P(tmp));
+			}
 
 			zval *zstype = Z_VAR_ENC_STYPE_P(tmp);
 			if (Z_TYPE_P(zstype) == IS_STRING) {
@@ -3621,7 +3624,7 @@ static encodePtr get_array_type(xmlNodePtr node, zval *array, smart_str *type)
 		i++;
 	} ZEND_HASH_FOREACH_END();
 
-	if (different || i == 0) {
+	if (different || i == 0 || cur_type == UNKNOWN_TYPE) {
 		smart_str_appendl(type, "xsd:anyType", sizeof("xsd:anyType")-1);
 		return get_conversion(XSD_ANYTYPE);
 	} else {

Fix phpGH-20011: Array of SoapVar of unknown type causes crash

Fix GH-20011: Array of SoapVar of unknown type causes crash

Merge branch 'PHP-8.3' into PHP-8.4

Merge branch 'PHP-8.4' into PHP-8.5

Merge branch 'PHP-8.5'

Navigation Menu

Repository navigation

Array of SoapVar of unknown type causes crash #20011

Description

PHP Version

Operating System

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Array of SoapVar of unknown type causes crash #20011

Description

Description

PHP Version

Operating System

Activity

ndossche commented on Sep 30, 2025

ndossche commented on Sep 30, 2025

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions