Description:
------------
SoapClient segfaults php in 5.5.23 and 5.6.7. 5.5.22 and 5.6.6 are OK. Current PHP-5.5 branch git checkouts still segfaults.

Git bisect found the following commit to be causing the problem:
https://github.com/php/php-src/commit/c8eaca013a3922e8383def6158ece2b63f6ec483
"Added type checks"

To reproduce, configure php with ./configure --disable-all --enable-cli --enable-soap --enable-libxml and run the linked test script using the cli sapi.
 
Note the script is not meant to actually work, the demo webservice does not accept the extra header. I just failed to find a public web service using extra headers to demo the problem and I could not expose the internal service that uses them. But segfault is the same.

master (7.x) does not segfault but seems to have some other issue with this code or wsdl but I have not investigated that further.


Test script:
---------------
<?php
// Create Security header
$secns = "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd";
$token = new stdClass;
$token->Username = new SOAPVar('bugs_php_net_test', XSD_STRING, null, null, null, $secns);
$token->Password = new SOAPVar('bugs_php_net_test', XSD_STRING, null, null, null, $secns);
$wsec = new stdClass;
$wsec->UsernameToken = new SoapVar($token, SOAP_ENC_OBJECT, null, null, null, $secns);
$headers = new SOAPHeader($secns, 'Security', $wsec, true);

// Go go go
$client = new SoapClient("http://www.webservicex.net/periodictable.asmx?WSDL", array('exceptions' => true, 'trace' => 1));
$client->__setSOAPHeaders($headers);
$client->GetAtomicNumber(array('ElementName' => 'Vanadium'));

Expected result:
----------------
Expected output would be a fatal SoapFault

Fatal error: Uncaught SoapFault exception: [soap:MustUnderstand] System.Web.Services.Protocols.SoapHeaderException: SOAP header Security was not understood.

Actual result:
--------------
Starting program: /home/atomt/temp/php5-bisect/php-5.5.23/sapi/cli/php ~/temp/php5-bisect/test.php

Program received signal SIGSEGV, Segmentation fault.
0x00000000004aaca2 in master_to_xml_int (encode=0xa0abb8 <defaultEncoding+504>, data=data@entry=0x7ffff7fcc160, style=style@entry=2, parent=parent@entry=0xb4a2f0, 
    check_class_map=check_class_map@entry=1) at /home/atomt/temp/php5-bisect/php-5.5.23/ext/soap/php_encoding.c:467
467			    Z_TYPE_PP(zname) == IS_STRING) {
(gdb) bt
#0  0x00000000004aaca2 in master_to_xml_int (encode=0xa0abb8 <defaultEncoding+504>, data=data@entry=0x7ffff7fcc160, style=style@entry=2, parent=parent@entry=0xb4a2f0, 
    check_class_map=check_class_map@entry=1) at /home/atomt/temp/php5-bisect/php-5.5.23/ext/soap/php_encoding.c:467
#1  0x00000000004ac8a5 in master_to_xml (parent=0xb4a2f0, style=2, data=0x7ffff7fcc160, encode=<optimized out>) at /home/atomt/temp/php5-bisect/php-5.5.23/ext/soap/php_encoding.c:539
#2  to_xml_object (type=0xa0b6e0 <defaultEncoding+3360>, data=0x7ffff7fca528, style=2, parent=<optimized out>) at /home/atomt/temp/php5-bisect/php-5.5.23/ext/soap/php_encoding.c:2070
#3  0x00000000004aa8c6 in master_to_xml_int (encode=0xa0b6e0 <defaultEncoding+3360>, data=0x7ffff7fca528, style=2, parent=0xb4a250, check_class_map=<optimized out>)
    at /home/atomt/temp/php5-bisect/php-5.5.23/ext/soap/php_encoding.c:528
#4  0x00000000004aac0d in master_to_xml_int (encode=0xa0abb8 <defaultEncoding+504>, data=data@entry=0x7ffff7fcb1a8, style=style@entry=2, parent=parent@entry=0xb4a250, 
    check_class_map=check_class_map@entry=1) at /home/atomt/temp/php5-bisect/php-5.5.23/ext/soap/php_encoding.c:447
#5  0x00000000004ac8a5 in master_to_xml (parent=0xb4a250, style=2, data=0x7ffff7fcb1a8, encode=<optimized out>) at /home/atomt/temp/php5-bisect/php-5.5.23/ext/soap/php_encoding.c:539
#6  to_xml_object (type=0xa0abb8 <defaultEncoding+504>, data=0x7ffff7fcc280, style=2, parent=<optimized out>) at /home/atomt/temp/php5-bisect/php-5.5.23/ext/soap/php_encoding.c:2070
#7  0x00000000004aa8c6 in master_to_xml_int (encode=0xa0abb8 <defaultEncoding+504>, data=0x7ffff7fcc280, style=2, parent=0xb49ea0, check_class_map=<optimized out>)
    at /home/atomt/temp/php5-bisect/php-5.5.23/ext/soap/php_encoding.c:528
#8  0x00000000004aa8c6 in master_to_xml_int (encode=0xa0a9c0 <defaultEncoding>, encode@entry=0x0, data=0x7ffff7fcc280, style=style@entry=2, parent=parent@entry=0xb49ea0, 
    check_class_map=check_class_map@entry=1) at /home/atomt/temp/php5-bisect/php-5.5.23/ext/soap/php_encoding.c:528
#9  0x00000000004ab05b in master_to_xml (encode=encode@entry=0x0, data=<optimized out>, style=style@entry=2, parent=parent@entry=0xb49ea0)
    at /home/atomt/temp/php5-bisect/php-5.5.23/ext/soap/php_encoding.c:539
#10 0x000000000049fac5 in serialize_function_call (this_ptr=<optimized out>, function=<optimized out>, function_name=<optimized out>, uri=<optimized out>, arguments=<optimized out>, 
    arg_count=<optimized out>, version=1, soap_headers=0x7ffff7fce2e8) at /home/atomt/temp/php5-bisect/php-5.5.23/ext/soap/soap.c:4377
#11 0x00000000004a563d in do_soap_call (this_ptr=0x7ffff7fcb22b, this_ptr@entry=0x7ffff7fcb728, function=0x708351 "Wrong 'typemap' option", arg_count=11, arg_count@entry=1, 
    real_args=0x736e65 <ht_bucket_html4_076+5>, real_args@entry=0x0, return_value=0x4, return_value@entry=0x7ffff7fd0568, 
    location=0x652fb767fe9 <error: Cannot access memory at address 0x652fb767fe9>, location@entry=0x7ffff7fce2e8 "\b", soap_action=0x0, call_uri=0x0, soap_headers=0x7ffff7fce2e8, 
    output_headers=0x0, function_len=<optimized out>) at /home/atomt/temp/php5-bisect/php-5.5.23/ext/soap/soap.c:2719
#12 0x00000000004a5dea in zim_SoapClient___call (ht=<optimized out>, return_value=0x7ffff7fd0568, return_value_ptr=<optimized out>, this_ptr=0x7ffff7fcb728, 
    return_value_used=<optimized out>) at /home/atomt/temp/php5-bisect/php-5.5.23/ext/soap/soap.c:2943
#13 0x00000000005bde78 in zend_call_function (fci=0x7fffffffa160, fci_cache=0x7fffffffa130) at /home/atomt/temp/php5-bisect/php-5.5.23/Zend/zend_execute_API.c:952
#14 0x00000000005e339f in zend_call_method (object_pp=object_pp@entry=0x7fffffffa218, obj_ce=<optimized out>, obj_ce@entry=0xac8060, fn_proxy=fn_proxy@entry=0xac81b8, 
    function_name=function_name@entry=0x708cb7 "__call", function_name_len=function_name_len@entry=6, retval_ptr_ptr=retval_ptr_ptr@entry=0x7fffffffa230, param_count=2, 
    arg1=0x7ffff7fd0370, arg2=0x7ffff7fce370) at /home/atomt/temp/php5-bisect/php-5.5.23/Zend/zend_interfaces.c:97
#15 0x00000000005ef734 in zend_std_call_user_call (ht=<optimized out>, return_value=0x7ffff7fce0c8, return_value_ptr=<optimized out>, this_ptr=0x7ffff7fcb728, 
    return_value_used=<optimized out>) at /home/atomt/temp/php5-bisect/php-5.5.23/Zend/zend_object_handlers.c:899
#16 0x00000000006818b7 in zend_do_fcall_common_helper_SPEC (execute_data=0x7ffff7f954c0) at /home/atomt/temp/php5-bisect/php-5.5.23/Zend/zend_vm_execute.h:550
#17 0x00000000005f69a8 in execute_ex (execute_data=0x7ffff7f954c0) at /home/atomt/temp/php5-bisect/php-5.5.23/Zend/zend_vm_execute.h:363
#18 0x00000000005ccfed in zend_execute_scripts (type=8, retval=0x708351, retval@entry=0x0, file_count=3) at /home/atomt/temp/php5-bisect/php-5.5.23/Zend/zend.c:1327
#19 0x000000000056b350 in php_execute_script (primary_file=0x7fffffffc7e0) at /home/atomt/temp/php5-bisect/php-5.5.23/main/main.c:2525
#20 0x0000000000683a57 in do_cli (argc=-134434261, argv=0x708351) at /home/atomt/temp/php5-bisect/php-5.5.23/sapi/cli/php_cli.c:994
#21 0x000000000041fee4 in main (argc=-134434261, argv=0x708351) at /home/atomt/temp/php5-bisect/php-5.5.23/sapi/cli/php_cli.c:1378