Repository navigation
Conversation
When decoding a response header threw an exception, for example from a typemap "from_xml" callback, parse_packet_soap() went on decoding the remaining headers and adding them to the output headers array. The trace of the exception holds a copy of that array (the argument of __soapCall()), so the array is shared: a debug build fails with an assertion in _zend_hash_str_add_or_update_i(), and a release build changes the array that the trace shows. Stop decoding the headers once an exception is pending. The headers decoded before it stay in the output array. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When decoding a response header throws an exception, for example from a typemap
from_xmlcallback,parse_packet_soap()goes on decoding the remaining headers and adds them to the output headers array (the 5th argument of__soapCall()). The trace of the exception holds a copy of that argument, so the array is shared at that point:_zend_hash_str_add_or_update_i: Assertion '(zend_gc_refcount(&(ht)->gc) == 1) || ((ht)->u.flags & (1<<6))' failed;h1,h2(whose callback throws) andh3,$e->getTrace()[1]['args'][4]contains all three instead of['h1' => 1], which was the value when the exception was thrown.This stops decoding the headers once an exception is pending. The headers decoded before it stay in the output array, as the test shows.
I found it while testing #24367, which stops decoding headers after an encoding error for the same reason. The loop is unchanged since PHP 7 (c446e57), and master has the same problem. Merging up into master conflicts in one line (master casts
trav->nametoconst char*in theadd_assoc_zval()call).Testing, debug build of PHP-8.4 (
25348e809d4):output_headers_exception.phptpasses; without the fix it fails with the assertion above, and on a release build (ASAN) without the fix it fails on the arrays, which containh2 => NULLandh3 => 3;ext/soap: all tests pass.🤖 Generated with Claude Code