Fix GH-16259: Soap segfault when classmap instantiation fails

Instantiation failure checks were missing.

Closes GH-16273.

Author: nielsdos

NEWS

@@ -91,6 +91,8 @@ PHP                                                                        NEWS
   . Fix Soap leaking http_msg on error. (nielsdos)
   . Fixed bug GH-16256 (Assertion failure in ext/soap/php_encoding.c:460).
     (nielsdos)
+  . Fixed bug GH-16259 (Soap segfault when classmap instantiation fails).
+    (nielsdos)
 
 - Standard:
   . Fixed bug GH-15613 (overflow on unpack call hex string repeater).

ext/soap/php_encoding.c

@@ -1408,7 +1408,9 @@ static zval *to_zval_object_ex(zval *ret, encodeTypePtr type, xmlNodePtr data, z
 					return ret;
 				}
 
-				object_init_ex(ret, ce);
+				if (object_init_ex(ret, ce) != SUCCESS) {
+					return ret;
+				}
 				master_to_zval_int(&base, enc, data);
 				set_zval_property(ret, "_", &base);
 			} else {
@@ -1417,7 +1419,9 @@ static zval *to_zval_object_ex(zval *ret, encodeTypePtr type, xmlNodePtr data, z
 				if (soap_check_xml_ref(ret, data)) {
 					return ret;
 				}
-				object_init_ex(ret, ce);
+				if (object_init_ex(ret, ce) != SUCCESS) {
+					return ret;
+				}
 				soap_add_xml_ref(ret, data);
 			}
 		} else if (sdlType->kind == XSD_TYPEKIND_EXTENSION &&
@@ -1462,7 +1466,9 @@ static zval *to_zval_object_ex(zval *ret, encodeTypePtr type, xmlNodePtr data, z
 					return ret;
 				}
 
-				object_init_ex(ret, ce);
+				if (object_init_ex(ret, ce) != SUCCESS) {
+					return ret;
+				}
 				soap_add_xml_ref(ret, data);
 				master_to_zval_int(&base, sdlType->encode, data);
 				set_zval_property(ret, "_", &base);
@@ -1473,7 +1479,9 @@ static zval *to_zval_object_ex(zval *ret, encodeTypePtr type, xmlNodePtr data, z
 			if (soap_check_xml_ref(ret, data)) {
 				return ret;
 			}
-			object_init_ex(ret, ce);
+			if (object_init_ex(ret, ce) != SUCCESS) {
+				return ret;
+			}
 			soap_add_xml_ref(ret, data);
 		}
 		if (sdlType->model) {
@@ -1533,7 +1541,9 @@ static zval *to_zval_object_ex(zval *ret, encodeTypePtr type, xmlNodePtr data, z
 			return ret;
 		}
 
-		object_init_ex(ret, ce);
+		if (object_init_ex(ret, ce) != SUCCESS) {
+			return ret;
+		}
 		soap_add_xml_ref(ret, data);
 		trav = data->children;
 

ext/soap/tests/bugs/gh16259.phpt

@@ -0,0 +1,23 @@
+--TEST--
+GH-16259 (Soap segfault when classmap instantiation fails)
+--EXTENSIONS--
+soap
+--FILE--
+<?php
+abstract class CT_A1 {
+}
+class CT_A2 extends CT_A1 {
+}
+
+$classMap = array("A1" => "CT_A1", "A2" => "CT_A2");
+$client = new SoapClient(__DIR__."/bug36575.wsdl", array("trace" => 1, "exceptions" => 0));
+$a2 = new CT_A2();
+$client->test($a2);
+$soapRequest = $client->__getLastRequest();
+
+$server = new SoapServer(__DIR__."/bug36575.wsdl", array("classmap" => $classMap));
+$server->handle($soapRequest);
+?>
+--EXPECT--
+<?xml version="1.0" encoding="UTF-8"?>
+<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"><SOAP-ENV:Body><SOAP-ENV:Fault><faultcode>SOAP-ENV:Server</faultcode><faultstring>Cannot instantiate abstract class CT_A1</faultstring></SOAP-ENV:Fault></SOAP-ENV:Body></SOAP-ENV:Envelope>