Skip to content

Commit 8a0a931

Browse files
committed
apply suggestions from code review
1 parent badb0f9 commit 8a0a931

2 files changed

Lines changed: 26 additions & 3 deletions

File tree

ext/soap/php_encoding.c

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2695,13 +2695,16 @@ static zval *to_zval_array(zval *ret, encodeTypePtr type, xmlNodePtr data)
26952695
/* Increment position */
26962696
i = dimension;
26972697
while (i > 0) {
2698-
i--;
2698+
i--;
26992699
if (pos[i] == INT_MAX) {
2700+
efree(dims);
2701+
efree(pos);
2702+
zval_ptr_dtor(ret);
27002703
soap_error0(E_ERROR, "Encoding: array index out of range");
27012704
}
2702-
pos[i]++;
2705+
pos[i]++;
27032706
if (pos[i] < dims[i]) {
2704-
break;
2707+
break;
27052708
}
27062709
if (i > 0) {
27072710
pos[i] = 0;

ext/soap/tests/soap_array_index_overflow.phpt

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,20 @@ function test_overflow(string $name, string $response): void {
4848
}
4949
}
5050

51+
function test_boundary_position(): void {
52+
$client = new TestSoapClient(NULL, [
53+
'location' => 'test://',
54+
'uri' => 'http://example.org/',
55+
'exceptions' => true,
56+
]);
57+
$client->response = soap_response(
58+
'SOAP-ENC:arrayType="xsd:string[1]" xsi:type="SOAP-ENC:Array"',
59+
'SOAP-ENC:position="[2147483646]"'
60+
);
61+
62+
var_dump($client->test());
63+
}
64+
5165
test_overflow(
5266
'arrayType',
5367
soap_response('SOAP-ENC:arrayType="xsd:string[2147483648]" xsi:type="SOAP-ENC:Array"')
@@ -62,8 +76,14 @@ test_overflow(
6276
'position',
6377
soap_response('SOAP-ENC:arrayType="xsd:string[1]" xsi:type="SOAP-ENC:Array"', 'SOAP-ENC:position="[2147483647]"')
6478
);
79+
80+
test_boundary_position();
6581
?>
6682
--EXPECT--
6783
arrayType: SOAP-ERROR: Encoding: array index out of range
6884
offset: SOAP-ERROR: Encoding: array index out of range
6985
position: SOAP-ERROR: Encoding: array index out of range
86+
array(1) {
87+
[2147483646]=>
88+
string(5) "value"
89+
}

0 commit comments

Comments
 (0)