@@ -4,16 +4,28 @@ SOAP array index overflow is rejected
44soap
55--FILE--
66<?php
7- class TestSoapClient extends SoapClient {
8- public string $ response ;
7+ $ serverCode = <<<'PHP'
8+ function test($arg) {}
9+ $server = new SoapServer(null, ['uri' => 'http://example.org/']);
10+ $server->addFunction('test');
11+ $server->handle(file_get_contents('php://stdin'));
12+ PHP;
913
10- public function __doRequest ($ request , $ location , $ action , $ version , $ one_way = false , ?string $ uriParserClass = null ): string {
11- return $ this ->response ;
12- }
14+ $ phpArgs = [
15+ '-d ' ,
16+ 'display_startup_errors=0 ' ,
17+ '-d ' ,
18+ 'extension_dir= ' . ini_get ('extension_dir ' ),
19+ '-d ' ,
20+ 'extension= ' . (substr (PHP_OS , 0 , 3 ) === 'WIN ' ? 'php_ ' : '' ) . 'soap. ' . PHP_SHLIB_SUFFIX ,
21+ '-r ' ,
22+ $ serverCode ,
23+ ];
24+ if (php_ini_loaded_file ()) {
25+ array_splice ($ phpArgs , 0 , 0 , ['-c ' , php_ini_loaded_file ()]);
1326}
1427
15- function soap_response (string $ attributes , string $ itemAttributes = '' ): string {
16- return <<<XML
28+ $ arrayTypeRequest = <<<XML
1729<?xml version="1.0" encoding="UTF-8"?>
1830<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"
1931 xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/"
@@ -22,48 +34,91 @@ function soap_response(string $attributes, string $itemAttributes = ''): string
2234 xmlns:ns1="http://example.org/"
2335 SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
2436 <SOAP-ENV:Body>
25- <ns1:testResponse >
26- <return $ attributes >
27- <item xsi:type="xsd:string" $ itemAttributes >value</item>
28- </return >
29- </ns1:testResponse >
37+ <ns1:test >
38+ <arg SOAP-ENC:arrayType="xsd:string[2147483648]" xsi:type="SOAP-ENC:Array" >
39+ <item xsi:type="xsd:string">value</item>
40+ </arg >
41+ </ns1:test >
3042 </SOAP-ENV:Body>
3143</SOAP-ENV:Envelope>
3244XML ;
33- }
3445
35- function test_overflow (string $ name , string $ response ): void {
36- $ client = new TestSoapClient (NULL , [
37- 'location ' => 'test:// ' ,
38- 'uri ' => 'http://example.org/ ' ,
39- 'exceptions ' => true ,
40- ]);
41- $ client ->response = $ response ;
46+ echo "arrayType: \n" ;
47+ $ process = proc_open ([PHP_BINARY , ...$ phpArgs ], [
48+ 0 => ['pipe ' , 'r ' ],
49+ 1 => ['pipe ' , 'w ' ],
50+ ], $ pipes );
51+ fwrite ($ pipes [0 ], $ arrayTypeRequest );
52+ fclose ($ pipes [0 ]);
53+ echo stream_get_contents ($ pipes [1 ]);
54+ fclose ($ pipes [1 ]);
55+ proc_close ($ process );
4256
43- try {
44- $ client ->test ();
45- echo "$ name: no fault \n" ;
46- } catch (SoapFault $ e ) {
47- echo "$ name: $ e ->faultstring \n" ;
48- }
49- }
57+ $ offsetRequest = <<<XML
58+ <?xml version="1.0" encoding="UTF-8"?>
59+ <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"
60+ xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/"
61+ xmlns:xsd="http://www.w3.org/2001/XMLSchema"
62+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
63+ xmlns:ns1="http://example.org/"
64+ SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
65+ <SOAP-ENV:Body>
66+ <ns1:test>
67+ <arg SOAP-ENC:arrayType="xsd:string[1]" SOAP-ENC:offset="[2147483648]" xsi:type="SOAP-ENC:Array">
68+ <item xsi:type="xsd:string">value</item>
69+ </arg>
70+ </ns1:test>
71+ </SOAP-ENV:Body>
72+ </SOAP-ENV:Envelope>
73+ XML ;
5074
51- test_overflow (
52- 'arrayType ' ,
53- soap_response ('SOAP-ENC:arrayType="xsd:string[2147483648]" xsi:type="SOAP-ENC:Array" ' )
54- );
75+ echo "offset: \n" ;
76+ $ process = proc_open ([PHP_BINARY , ...$ phpArgs ], [
77+ 0 => ['pipe ' , 'r ' ],
78+ 1 => ['pipe ' , 'w ' ],
79+ ], $ pipes );
80+ fwrite ($ pipes [0 ], $ offsetRequest );
81+ fclose ($ pipes [0 ]);
82+ echo stream_get_contents ($ pipes [1 ]);
83+ fclose ($ pipes [1 ]);
84+ proc_close ($ process );
5585
56- test_overflow (
57- 'offset ' ,
58- soap_response ('SOAP-ENC:arrayType="xsd:string[1]" SOAP-ENC:offset="[2147483648]" xsi:type="SOAP-ENC:Array" ' )
59- );
86+ $ positionRequest = <<<XML
87+ <?xml version="1.0" encoding="UTF-8"?>
88+ <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"
89+ xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/"
90+ xmlns:xsd="http://www.w3.org/2001/XMLSchema"
91+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
92+ xmlns:ns1="http://example.org/"
93+ SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
94+ <SOAP-ENV:Body>
95+ <ns1:test>
96+ <arg SOAP-ENC:arrayType="xsd:string[1]" xsi:type="SOAP-ENC:Array">
97+ <item xsi:type="xsd:string" SOAP-ENC:position="[2147483647]">value</item>
98+ </arg>
99+ </ns1:test>
100+ </SOAP-ENV:Body>
101+ </SOAP-ENV:Envelope>
102+ XML ;
60103
61- test_overflow (
62- 'position ' ,
63- soap_response ('SOAP-ENC:arrayType="xsd:string[1]" xsi:type="SOAP-ENC:Array" ' , 'SOAP-ENC:position="[2147483647]" ' )
64- );
104+ echo "position: \n" ;
105+ $ process = proc_open ([PHP_BINARY , ...$ phpArgs ], [
106+ 0 => ['pipe ' , 'r ' ],
107+ 1 => ['pipe ' , 'w ' ],
108+ ], $ pipes );
109+ fwrite ($ pipes [0 ], $ positionRequest );
110+ fclose ($ pipes [0 ]);
111+ echo stream_get_contents ($ pipes [1 ]);
112+ fclose ($ pipes [1 ]);
113+ proc_close ($ process );
65114?>
66115--EXPECT--
67- arrayType: SOAP-ERROR: Encoding: array index out of range
68- offset: SOAP-ERROR: Encoding: array index out of range
69- position: SOAP-ERROR: Encoding: array index out of range
116+ arrayType:
117+ <? xml version="1.0 " encoding="UTF -8 "?>
118+ <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"><SOAP-ENV:Body><SOAP-ENV:Fault><faultcode>SOAP-ENV:Server</faultcode><faultstring>SOAP-ERROR: Encoding: array index out of range</faultstring></SOAP-ENV:Fault></SOAP-ENV:Body></SOAP-ENV:Envelope>
119+ offset:
120+ <? xml version="1.0 " encoding="UTF -8 "?>
121+ <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"><SOAP-ENV:Body><SOAP-ENV:Fault><faultcode>SOAP-ENV:Server</faultcode><faultstring>SOAP-ERROR: Encoding: array index out of range</faultstring></SOAP-ENV:Fault></SOAP-ENV:Body></SOAP-ENV:Envelope>
122+ position:
123+ <? xml version="1.0 " encoding="UTF -8 "?>
124+ <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"><SOAP-ENV:Body><SOAP-ENV:Fault><faultcode>SOAP-ENV:Server</faultcode><faultstring>SOAP-ERROR: Encoding: array index out of range</faultstring></SOAP-ENV:Fault></SOAP-ENV:Body></SOAP-ENV:Envelope>
0 commit comments