ext/soap: report encoding errors without a bailout

Errors in encoding a request or decoding a response were raised with soap_errorN(E_ERROR, ...). SoapClient turned the fatal error into a SoapFault and caught the bailout in SOAP_CLIENT_END_CODE(), but zend_bailout() had already called gc_protect(1), so the cycle collector stayed off for the rest of the request (GH-10026).

These errors are now reported with soap_encoding_error(). In a call of a SoapClient that uses exceptions it throws the same SoapFault as before (same message, fault code "Client", also stored in __soap_fault) and returns: the encoder returns a placeholder value that its callers can handle, and the call discards the request or the response. Only the first error is thrown; once it is pending, master_to_xml() and master_to_zval() skip the rest of the value, the request is not sent, and decoded values are no longer stored, so a typed property or the shared array of output headers cannot be written to. Skipping the rest also keeps a cycle of references that fails with "Nesting level too deep" from taking exponential time.

SoapServer and SoapClient with the "exceptions" option disabled still get the same fatal error as before.

get_conversion() can now return NULL after the error, so guess_xml_convert() and get_array_type() handle that instead of recursing or dereferencing it.

One case behaves differently: if a callback (for example a typemap) has already thrown an exception when the error happens, that exception becomes the previous exception of the SoapFault. Before, the fatal error printed it as an uncaught exception warning and discarded it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: likemusic

NEWS

@@ -106,6 +106,9 @@ PHP                                                                        NEWS
   . SoapClient no longer bails out on WSDL and XML schema errors, which kept
     the cycle collector disabled for the rest of the request (GH-10026).
     (Valery Ivashchanka)
+  . SoapClient no longer bails out on errors in encoding a request or decoding
+    a response, which kept the cycle collector disabled for the rest of the
+    request (GH-10026). (Valery Ivashchanka)
 
 - SPL:
   . Fixed bug GH-23385 (SplDoublyLinkedList::serialize() use-after-free when

ext/soap/php_encoding.c

@@ -261,17 +261,22 @@ bool parse_packet_soap(zval *this_ptr, zend_string *buffer, sdlFunctionPtr fn, z
 				master_to_zval_with_doc_cleanup(&details, NULL, tmp, response);
 			}
 		}
-		add_soap_fault(this_ptr, faultcode, faultstring ? ZSTR_VAL(faultstring) : NULL, faultactor, &details, lang);
+		if (SOAP_ENCODING_ERROR_THROWN()) {
+			/* Decoding the fault failed, the client reports that error instead */
+			zval_ptr_dtor(&details);
+		} else {
+			add_soap_fault(this_ptr, faultcode, faultstring ? ZSTR_VAL(faultstring) : NULL, faultactor, &details, lang);
+			if (Z_REFCOUNTED(details)) {
+				Z_DELREF(details);
+			}
+		}
 		if (faultstring) {
 			zend_string_release_ex(faultstring, 0);
 		}
 		if (faultactor) {
 			zend_string_release_ex(faultactor, 0);
 		}
 		zend_string_release_ex(lang, false);
-		if (Z_REFCOUNTED(details)) {
-			Z_DELREF(details);
-		}
 		xmlFreeDoc(response);
 		return false;
 	}
@@ -442,12 +447,23 @@ bool parse_packet_soap(zval *this_ptr, zend_string *buffer, sdlFunctionPtr fn, z
 					smart_str_free(&key);
 				}
 				master_to_zval_with_doc_cleanup(&val, enc, trav, response);
+				if (SOAP_ENCODING_ERROR_THROWN()) {
+					/* The trace of the SoapFault shares the array of output headers */
+					zval_ptr_dtor(&val);
+					break;
+				}
 				add_assoc_zval(soap_headers, (const char*)trav->name, &val);
 			}
 			trav = trav->next;
 		}
 	}
 
+	if (SOAP_ENCODING_ERROR_THROWN()) {
+		/* The result is incomplete */
+		zval_ptr_dtor(return_value);
+		ZVAL_NULL(return_value);
+	}
+
 	xmlFreeDoc(response);
 	return true;
 }

ext/soap/php_packet_soap.c

@@ -202,6 +202,34 @@ void add_soap_fault(zval *obj, const char *fault_code, const char *fault_string,
 
 ZEND_COLD void soap_throw_error(const char *format, ...) ZEND_ATTRIBUTE_FORMAT(printf, 1, 2);
 
+typedef enum {
+	SOAP_ENCODING_ERROR_FATAL,
+	SOAP_ENCODING_ERROR_THROW,
+	SOAP_ENCODING_ERROR_IGNORE,
+} soap_encoding_error_mode;
+
+soap_encoding_error_mode soap_get_encoding_error_mode(void);
+
+/* Reports an error in encoding or decoding a value. It is a fatal error, as with soap_errorN(E_ERROR, ...), except in a
+ * call of a SoapClient that uses exceptions: there it is thrown as a SoapFault and does not bail out, so the encoder
+ * must return a value its callers can handle. The call discards the result once encoding is done. */
+#define soap_encoding_error(...) do { \
+		switch (soap_get_encoding_error_mode()) { \
+			case SOAP_ENCODING_ERROR_FATAL: \
+				php_error(E_ERROR, "SOAP-ERROR: " __VA_ARGS__); \
+				break; \
+			case SOAP_ENCODING_ERROR_THROW: \
+				soap_throw_error(__VA_ARGS__); \
+				break; \
+			case SOAP_ENCODING_ERROR_IGNORE: \
+				break; \
+		} \
+	} while (0)
+
+/* An encoding error has been thrown as a SoapFault: the rest of the call is skipped */
+#define SOAP_ENCODING_ERROR_THROWN() \
+	(UNEXPECTED(EG(exception)) && soap_get_encoding_error_mode() == SOAP_ENCODING_ERROR_IGNORE)
+
 #define soap_error0(severity, format) \
 	php_error(severity, "SOAP-ERROR: " format)
 

ext/soap/php_soap.h

@@ -2027,6 +2027,24 @@ ZEND_COLD void soap_throw_error(const char *format, ...) /* {{{ */
 }
 /* }}} */
 
+/* Encoding errors are thrown only where a fatal error used to become a SoapFault: in a call of a SoapClient that uses
+ * exceptions. Only the first one is thrown, the encoding that is still running after it reports nothing. */
+soap_encoding_error_mode soap_get_encoding_error_mode(void) /* {{{ */
+{
+	zval *client = &SOAP_GLOBAL(error_object);
+
+	if (!Z_OBJ_P(client) ||
+	    !instanceof_function(Z_OBJCE_P(client), soap_class_entry) ||
+	    Z_TYPE_P(Z_CLIENT_EXCEPTIONS_P(client)) == IS_FALSE) {
+		return SOAP_ENCODING_ERROR_FATAL;
+	}
+	if (EG(exception) && instanceof_function(EG(exception)->ce, soap_fault_class_entry)) {
+		return SOAP_ENCODING_ERROR_IGNORE;
+	}
+	return SOAP_ENCODING_ERROR_THROW;
+}
+/* }}} */
+
 /* SoapServer and SoapClient with the "exceptions" option disabled report
  * errors as fatal errors. Turns the SoapFault thrown by soap_throw_error()
  * into the same fatal error that soap_errorN(E_ERROR, ...) raises. */
@@ -2587,6 +2605,7 @@ static void do_soap_call(zend_execute_data *execute_data,
 		SOAP_GLOBAL(features) = 0;
 	}
 
+	ZVAL_NULL(&response);
 	zend_try {
 	 	if (sdl != NULL) {
 			fn = get_function(sdl, ZSTR_VAL(function), ZSTR_LEN(function));
@@ -2610,10 +2629,14 @@ static void do_soap_call(zend_execute_data *execute_data,
 				if (binding->bindingType == BINDING_SOAP) {
 					sdlSoapBindingFunctionPtr fnb = (sdlSoapBindingFunctionPtr)fn->bindingAttributes;
 					request = serialize_function_call(this_ptr, fn, NULL, fnb->input.ns, real_args, arg_count, soap_version, soap_headers);
-					ret = do_request(this_ptr, request, location_c_str, fnb->soapAction, soap_version, one_way, &response);
+					if (!SOAP_ENCODING_ERROR_THROWN()) {
+						ret = do_request(this_ptr, request, location_c_str, fnb->soapAction, soap_version, one_way, &response);
+					}
 				} else {
 	 				request = serialize_function_call(this_ptr, fn, NULL, sdl->target_ns, real_args, arg_count, soap_version, soap_headers);
-					ret = do_request(this_ptr, request, location_c_str, NULL, soap_version, one_way, &response);
+					if (!SOAP_ENCODING_ERROR_THROWN()) {
+						ret = do_request(this_ptr, request, location_c_str, NULL, soap_version, one_way, &response);
+					}
 				}
 
 				xmlFreeDoc(request);
@@ -2667,7 +2690,9 @@ static void do_soap_call(zend_execute_data *execute_data,
 				}
 				smart_str_0(&action);
 
-				ret = do_request(this_ptr, request, ZSTR_VAL(location), ZSTR_VAL(action.s), soap_version, 0, &response);
+				if (!SOAP_ENCODING_ERROR_THROWN()) {
+					ret = do_request(this_ptr, request, ZSTR_VAL(location), ZSTR_VAL(action.s), soap_version, 0, &response);
+				}
 
 		 		smart_str_free(&action);
 				xmlFreeDoc(request);

ext/soap/soap.c

@@ -0,0 +1,62 @@
+--TEST--
+GH-10026 (Garbage collection stops after exception in SoapClient): encoding errors
+--EXTENSIONS--
+soap
+--FILE--
+<?php
+class Node {
+    public $self;
+}
+
+function make_cycles(int $n): void {
+    for ($i = 0; $i < $n; $i++) {
+        $node = new Node;
+        $node->self = $node;
+    }
+}
+
+class TestSoapClient extends SoapClient {
+    public function __doRequest($request, $location, $action, $version, $oneWay = false, ?string $uriParserClass = null): string {
+        return <<<'XML'
+<?xml version="1.0" encoding="UTF-8"?>
+<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"
+                   xmlns:xsd="http://www.w3.org/2001/XMLSchema"
+                   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+  <SOAP-ENV:Body>
+    <ns1:testResponse xmlns:ns1="urn:test">
+      <return xsi:type="xsd:int">not a number</return>
+    </ns1:testResponse>
+  </SOAP-ENV:Body>
+</SOAP-ENV:Envelope>
+XML;
+    }
+}
+
+$client = new TestSoapClient(null, ['location' => 'test://', 'uri' => 'urn:test']);
+
+// Encoding the request fails
+try {
+    $client->test("\xff");
+} catch (SoapFault $e) {
+    echo $e->faultcode, ": ", $e->getMessage(), "\n";
+}
+var_dump(gc_status()['protected']);
+
+// Decoding the response fails
+try {
+    $client->test("ok");
+} catch (SoapFault $e) {
+    echo $e->faultcode, ": ", $e->getMessage(), "\n";
+}
+var_dump(gc_status()['protected']);
+
+make_cycles(20000);
+gc_collect_cycles();
+var_dump(gc_status()['collected']);
+?>
+--EXPECT--
+Client: SOAP-ERROR: Encoding: string '\xff...' is not a valid utf-8 string
+bool(false)
+Client: SOAP-ERROR: Encoding: Invalid value for type 'int'
+bool(false)
+int(20000)

ext/soap/tests/bugs/gh10026_encoding.phpt

@@ -0,0 +1,43 @@
+--TEST--
+SoapClient reports "Nesting level too deep" as SoapFault without a bailout
+--EXTENSIONS--
+soap
+--SKIPIF--
+<?php
+if (getenv('SKIP_ASAN')) {
+    die('skip ASAN needs different stack limit setting due to more stack space usage');
+}
+?>
+--FILE--
+<?php
+class TestSoapClient extends SoapClient {
+    public string $response;
+
+    public function __doRequest($request, $location, $action, $version, $oneWay = false, ?string $uriParserClass = null): string {
+        return $this->response;
+    }
+}
+
+$client = new TestSoapClient(null, ['location' => 'test://', 'uri' => 'urn:test']);
+
+// An array that contains itself 1 and 8 times: decoding stops at the first error
+foreach ([1, 8] as $n) {
+    $client->response = '<?xml version="1.0"?>'
+        . '<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"'
+        . ' xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:xsd="http://www.w3.org/2001/XMLSchema"'
+        . ' xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><SOAP-ENV:Body><ns1:testResponse xmlns:ns1="urn:test">'
+        . '<return xsi:type="SOAP-ENC:Array" SOAP-ENC:arrayType="xsd:anyType[' . $n . ']" id="x">'
+        . str_repeat('<i href="#x"/>', $n)
+        . '</return></ns1:testResponse></SOAP-ENV:Body></SOAP-ENV:Envelope>';
+    try {
+        $client->test();
+    } catch (SoapFault $e) {
+        echo "$n: $e->faultcode: $e->faultstring\n";
+    }
+}
+var_dump(gc_status()['protected']);
+?>
+--EXPECT--
+1: Client: SOAP-ERROR: Encoding: Nesting level too deep
+8: Client: SOAP-ERROR: Encoding: Nesting level too deep
+bool(false)