php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #30182 SOAP module processing WSDL file dumps core
Submitted: 2004-09-21 16:48 UTC Modified: 2004-09-22 07:59 UTC
From: dmiller at sparks dot net Assigned: dmitry
Status: Closed Package: Reproducible crash
PHP Version: 5CVS-2004-09-21 (dev) OS: FreeBSD 4.10
Private report: No CVE-ID:
 [2004-09-21 16:48 UTC] dmiller at sparks dot net
Description:
------------
$client = new SoapClient($wsdl); dumps core with a WSDL file 
given by a .NET server.

Core is not dumped on all wsdl's, it appears to not handle something in this particular file.

# ./configure  --enable-versioning --enable-memory-limit --with-layout=GNU --with-config-file-scan-dir=/usr/local/etc/php --disable-all --enable-libxml --with-libxml-dir=/usr/local --enable-spl --with-openssl --with-curl --with-regex=php --with-apxs=/usr/local/sbin/apxs --enable-debug --disable-ipv6 --prefix=/usr/local i386-portbld-freebsd4.10 --enable-soap


Reproduce code:
---------------
<?php

 $wsdl_url = './x';

$wsdl = '';
$wsdl_file = fopen($wsdl_url, "r");

while (!feof($wsdl_file)) {
    $wsdl .= fread($wsdl_file, 4096);
}
fclose ($wsdl_file);

$client = new SoapClient("$wsdl");

print ("Created new soap client:\n");

?>

wsdl, phpinfo, and sample code available at
http://search.sparks.net/php-wsdl-bug/

Expected result:
----------------
I expected to have a SOAP object created

Actual result:
--------------
Segmentation fault (core dumped)

new:php$ which php
/usr/local/bin/php
new:php$ gdb /usr/local/bin/php php.core
GNU gdb 4.18 (FreeBSD)
Copyright 1998 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-unknown-freebsd"...Deprecated bfd_read called at /usr/src
nu/usr.bin/binutils/gdb/../../../../contrib/gdb/gdb/dbxread.c line 2627 in elfstab_build_p
mtabs
Deprecated bfd_read called at /usr/src/gnu/usr.bin/binutils/gdb/../../../../contrib/gdb/gd
dbxread.c line 933 in fill_symbuf
 
Core was generated by `php'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /usr/lib/libcrypt.so.2...done.
Reading symbols from /usr/local/lib/libcurl.so.3...done.
Reading symbols from /usr/lib/libm.so.2...done.
Reading symbols from /usr/local/lib/libxml2.so.5...done.
Reading symbols from /usr/lib/libz.so.2...done.
Reading symbols from /usr/local/lib/libiconv.so.3...done.
Reading symbols from /usr/local/lib/libssl.so.3...done.
Reading symbols from /usr/local/lib/libcrypto.so.3...done.
Reading symbols from /usr/lib/libc.so.4...done.
Reading symbols from /usr/lib/libssl.so.3...done.
Reading symbols from /usr/lib/libcrypto.so.3...done.
Reading symbols from /usr/libexec/ld-elf.so.1...done.
#0  0x20202020 in ?? ()
(gdb) bt
#0  0x20202020 in ?? ()
Cannot access memory at address 0x20202020.
(gdb) new:php$
new:php$ 


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2004-09-22 07:59 UTC] dmitry@php.net
At first your code is wrong. You should use URL as first parameter to SoapClient constructor.

<?php
$wsdl_url = './x';
$client = new SoapClient($wsdl_url);
print ("Created new soap client:\n");
?>

Crash is fixed in CVS HEAD and PHP_5_0
 
PHP Copyright © 2001-2014 The PHP Group
All rights reserved.
Last updated: Wed Apr 16 07:02:02 2014 UTC