Skip to content

Commit 2e92877

Browse files
committed
apply suggestions from code review
1 parent 5e1497c commit 2e92877

2 files changed

Lines changed: 26 additions & 3 deletions

File tree

ext/soap/php_encoding.c

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2708,13 +2708,16 @@ static zval *to_zval_array(zval *ret, encodeTypePtr type, xmlNodePtr data)
27082708
/* Increment position */
27092709
i = dimension;
27102710
while (i > 0) {
2711-
i--;
2711+
i--;
27122712
if (pos[i] == INT_MAX) {
2713+
efree(dims);
2714+
efree(pos);
2715+
zval_ptr_dtor(ret);
27132716
soap_error0(E_ERROR, "Encoding: array index out of range");
27142717
}
2715-
pos[i]++;
2718+
pos[i]++;
27162719
if (pos[i] < dims[i]) {
2717-
break;
2720+
break;
27182721
}
27192722
if (i > 0) {
27202723
pos[i] = 0;

ext/soap/tests/soap_array_index_overflow.phpt

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,20 @@ function test_overflow(string $name, string $response): void {
4848
}
4949
}
5050

51+
function test_boundary_position(): void {
52+
$client = new TestSoapClient(NULL, [
53+
'location' => 'test://',
54+
'uri' => 'http://example.org/',
55+
'exceptions' => true,
56+
]);
57+
$client->response = soap_response(
58+
'SOAP-ENC:arrayType="xsd:string[1]" xsi:type="SOAP-ENC:Array"',
59+
'SOAP-ENC:position="[2147483646]"'
60+
);
61+
62+
var_dump($client->test());
63+
}
64+
5165
test_overflow(
5266
'arrayType',
5367
soap_response('SOAP-ENC:arrayType="xsd:string[2147483648]" xsi:type="SOAP-ENC:Array"')
@@ -62,8 +76,14 @@ test_overflow(
6276
'position',
6377
soap_response('SOAP-ENC:arrayType="xsd:string[1]" xsi:type="SOAP-ENC:Array"', 'SOAP-ENC:position="[2147483647]"')
6478
);
79+
80+
test_boundary_position();
6581
?>
6682
--EXPECT--
6783
arrayType: SOAP-ERROR: Encoding: array index out of range
6884
offset: SOAP-ERROR: Encoding: array index out of range
6985
position: SOAP-ERROR: Encoding: array index out of range
86+
array(1) {
87+
[2147483646]=>
88+
string(5) "value"
89+
}

0 commit comments

Comments
 (0)