Skip to content

Fix SoapClient writing to output headers after an exception - #24368

Open
likemusic wants to merge 1 commit into
php:PHP-8.4from
likemusic:fix-soap-header-exception
Open

likemusic wants to merge 1 commit into
php:PHP-8.4from
likemusic:fix-soap-header-exception

Conversation

@likemusic

Copy link
Copy Markdown

When decoding a response header throws an exception, for example from a typemap from_xml callback, parse_packet_soap() goes on decoding the remaining headers and adds them to the output headers array (the 5th argument of __soapCall()). The trace of the exception holds a copy of that argument, so the array is shared at that point:

  • a debug build fails with _zend_hash_str_add_or_update_i: Assertion '(zend_gc_refcount(&(ht)->gc) == 1) || ((ht)->u.flags & (1<<6))' failed;
  • a release build changes the array that the trace shows: with headers h1, h2 (whose callback throws) and h3, $e->getTrace()[1]['args'][4] contains all three instead of ['h1' => 1], which was the value when the exception was thrown.

This stops decoding the headers once an exception is pending. The headers decoded before it stay in the output array, as the test shows.

I found it while testing #24367, which stops decoding headers after an encoding error for the same reason. The loop is unchanged since PHP 7 (c446e57), and master has the same problem. Merging up into master conflicts in one line (master casts trav->name to const char* in the add_assoc_zval() call).

Testing, debug build of PHP-8.4 (25348e809d4):

  • the new test output_headers_exception.phpt passes; without the fix it fails with the assertion above, and on a release build (ASAN) without the fix it fails on the arrays, which contain h2 => NULL and h3 => 3;
  • ext/soap: all tests pass.

🤖 Generated with Claude Code

When decoding a response header threw an exception, for example from a typemap "from_xml" callback, parse_packet_soap() went on decoding the remaining headers and adding them to the output headers array. The trace of the exception holds a copy of that array (the argument of __soapCall()), so the array is shared: a debug build fails with an assertion in _zend_hash_str_add_or_update_i(), and a release build changes the array that the trace shows.

Stop decoding the headers once an exception is pending. The headers decoded before it stay in the output array.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant