File php-unserialize-soap-type-confusion.patch of Package php5.4029

From: Xinchen Hui <laruence@php.net>
Date: Fri, 27 Feb 2015 15:32:32 +0000 (+0800)
Subject: Fixed bug #69085 (SoapClient's __call() type confusion through unserialize()).
X-Git-Tag: php-5.5.23RC1~15
X-Git-Url: http://72.52.91.13:8000/?p=php-src.git;a=commitdiff_plain;h=997b7e56302710bb3db00b56d0629ac75d73a207

Fixed bug #69085 (SoapClient's __call() type confusion through unserialize()).
---

Index: ext/soap/soap.c
===================================================================
--- ext/soap/soap.c.orig	2015-03-31 15:01:28.820492972 +0200
+++ ext/soap/soap.c	2015-03-31 15:01:29.081496396 +0200
@@ -2557,7 +2557,7 @@
 	}
 
 	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "trace", sizeof("trace"), (void **) &trace) == SUCCESS &&
-	    Z_LVAL_PP(trace) > 0) {
+	    Z_TYPE_PP(trace) == IS_LONG && Z_LVAL_PP(trace) > 0) {
 		add_property_stringl(this_ptr, "__last_request", buf, buf_size, 1);
 	}
 
@@ -2597,7 +2597,7 @@
 		}
 		ret = FALSE;
 	} else if (zend_hash_find(Z_OBJPROP_P(this_ptr), "trace", sizeof("trace"), (void **) &trace) == SUCCESS &&
-	    Z_LVAL_PP(trace) > 0) {
+	    Z_TYPE_PP(trace) == IS_LONG && Z_LVAL_PP(trace) > 0) {
 		add_property_stringl(this_ptr, "__last_response", Z_STRVAL_P(response), Z_STRLEN_P(response), 1);
 	}
 	xmlFree(buf);
@@ -2887,7 +2887,7 @@
 	}
 
 	/* Add default headers */
-	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "__default_headers", sizeof("__default_headers"), (void **) &tmp)==SUCCESS) {
+	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "__default_headers", sizeof("__default_headers"), (void **) &tmp) == SUCCESS && Z_TYPE_PP(tmp) == IS_ARRAY) {
 		HashTable *default_headers = Z_ARRVAL_P(*tmp);
 		if (soap_headers) {
 			if (!free_soap_headers) {