php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #50219 soap call Segmentation fault on a redirected url
Submitted: 2009-11-18 14:41 UTC Modified: 2009-11-21 01:23 UTC
From: zedorg at gmail dot com Assigned: pierrick
Status: Closed Package: SOAP related
PHP Version: 5.3.0 OS: Any
Private report: No CVE-ID:
 [2009-11-18 14:41 UTC] zedorg at gmail dot com
Description:
------------
Making a soap call to an url which redirects, cause segfault in php.

Can reproduce in the following systems and versions: 
php 5.3(win32bit), php 5.2.9(linux, debian 64bit),  php 5.2.6(win32bit),



Reproduce code:
---------------
$s=new SoapClient('valid.wsdl',array('location'=>'http://www.horacero.com.mx','classmap'=>array('doAny'=>'DoAny'))); // passes
$s->doAny(null) // segfault here

Expected result:
----------------
throwing a SoapFault exception 

Actual result:
--------------
php Segmentation fault

Here is the last lines from strace output:

...
socket(PF_INET, SOCK_DGRAM, IPPROTO_IP) = 3
connect(3, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("216.52.254.1")}, 28) = 0
fcntl(3, F_GETFL)                       = 0x2 (flags O_RDWR)
fcntl(3, F_SETFL, O_RDWR|O_NONBLOCK)    = 0
poll([{fd=3, events=POLLOUT, revents=POLLOUT}], 1, 0) = 1
sendto(3, "\333\355\1\0\0\1\0\0\0\0\0\0\3www\10horacero\3com\2mx"..., 37, 0, NULL, 0) = 37
poll([{fd=3, events=POLLIN, revents=POLLIN}], 1, 5000) = 1
ioctl(3, FIONREAD, [136])               = 0
recvfrom(3, "\333\355\201\200\0\1\0\0\0\1\0\0\3www\10horacero\3com\2"..., 1024, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("216.52.254.1")}, [16]) = 136
close(3)                                = 0
socket(PF_INET, SOCK_DGRAM, IPPROTO_IP) = 3
connect(3, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("216.52.254.1")}, 28) = 0
fcntl(3, F_GETFL)                       = 0x2 (flags O_RDWR)
fcntl(3, F_SETFL, O_RDWR|O_NONBLOCK)    = 0
poll([{fd=3, events=POLLOUT, revents=POLLOUT}], 1, 0) = 1
sendto(3, "\271\315\1\0\0\1\0\0\0\0\0\0\3www\10horacero\3com\2mx"..., 48, 0, NULL, 0) = 48
poll([{fd=3, events=POLLIN, revents=POLLIN}], 1, 5000) = 1
ioctl(3, FIONREAD, [107])               = 0
recvfrom(3, "\271\315\201\200\0\1\0\0\0\1\0\0\3www\10horacero\3com\2"..., 1024, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("216.52.254.1")}, [16]) = 107
close(3)                                = 0
socket(PF_INET, SOCK_DGRAM, IPPROTO_IP) = 3
connect(3, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("216.52.254.1")}, 28) = 0
fcntl(3, F_GETFL)                       = 0x2 (flags O_RDWR)
fcntl(3, F_SETFL, O_RDWR|O_NONBLOCK)    = 0
poll([{fd=3, events=POLLOUT, revents=POLLOUT}], 1, 0) = 1
sendto(3, "\303a\1\0\0\1\0\0\0\0\0\0\3www\10horacero\3com\2mx"..., 37, 0, NULL, 0) = 37
poll([{fd=3, events=POLLIN, revents=POLLIN}], 1, 5000) = 1
ioctl(3, FIONREAD, [186])               = 0
recvfrom(3, "\303a\201\200\0\1\0\1\0\3\0\2\3www\10horacero\3com\2mx"..., 1024, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("216.52.254.1")}, [16]) = 186
close(3)                                = 0
socket(PF_INET, SOCK_STREAM, IPPROTO_IP) = 3
fcntl(3, F_GETFL)                       = 0x2 (flags O_RDWR)
fcntl(3, F_SETFL, O_RDWR|O_NONBLOCK)    = 0
connect(3, {sa_family=AF_INET, sin_port=htons(80), sin_addr=inet_addr("208.94.113.194")}, 16) = -1 EINPROGRESS (Operation now in progress)
poll([{fd=3, events=POLLIN|POLLOUT|POLLERR|POLLHUP, revents=POLLOUT}], 1, 60000) = 1
getsockopt(3, SOL_SOCKET, SO_ERROR, [0], [4]) = 0
fcntl(3, F_SETFL, O_RDWR)               = 0
sendto(3, "POST / HTTP/1.1\r\nHost: www.horac"..., 504, MSG_DONTWAIT, NULL, 0) = 504
poll([{fd=3, events=POLLIN|POLLERR|POLLHUP, revents=POLLIN}], 1, 60000) = 1
recvfrom(3, "HTTP/1.1 302 Object moved\r\nDate:"..., 8192, MSG_DONTWAIT, NULL, NULL) = 402
close(3)                                = 0
--- SIGSEGV (Segmentation fault) @ 0 (0) ---

The url: www dot horacero dot com dot mx gives the following headers:

HTTP/1.x 302 Object moved
Date: Wed, 18 Nov 2009 14:36:10 GMT
Location: portada/
Content-Length: 129
Content-Type: text/html
Cache-Control: private



Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2009-11-21 01:22 UTC] svn@php.net
Automatic comment from SVN on behalf of pierrick
Revision: http://svn.php.net/viewvc/?view=revision&revision=291104
Log: Fixed bug #50219 (soap call Segmentation fault on a redirected url).
 [2009-11-21 01:23 UTC] pierrick@php.net
This bug has been fixed in SVN.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.


 
PHP Copyright © 2001-2014 The PHP Group
All rights reserved.
Last updated: Wed Apr 23 18:01:55 2014 UTC