Skip to content

ext/soap: Fix SOAP xsd:hexBinary odd-length decoding#22698

Open
LamentXU123 wants to merge 1 commit into
php:masterfrom
LamentXU123:soap-rejection
Open

ext/soap: Fix SOAP xsd:hexBinary odd-length decoding#22698
LamentXU123 wants to merge 1 commit into
php:masterfrom
LamentXU123:soap-rejection

Conversation

@LamentXU123

@LamentXU123 LamentXU123 commented Jul 11, 2026

Copy link
Copy Markdown
Member

xsd:hexBinary values must contain an even number of hexadecimal digits.

However, previously we allocated strlen(content) / 2 bytes and decoded only complete byte pairs. As a result, an odd-length value such as ABC was accepted as ab (what...?), silently ignoring the trailing nibble.

Lets reject odd-length xsd:hexBinary values instead and throw an Error here which makes better sense. The error message is copied from other decoding errors. (I think in the future, we can make the decoding error message more useful, in bulk.)

 <?php
  class TestSoapClient extends SoapClient {
      public function __doRequest(
          $request,
          $location,
          $action,
          $version,
          $one_way = false,
          ?string $uriParserClass = null
      ): string {
          return <<<'XML'
  <?xml version="1.0" encoding="UTF-8"?>
  <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"
                     xmlns:xsd="http://www.w3.org/2001/XMLSchema"
                     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
    <SOAP-ENV:Body>
      <ns1:testResponse xmlns:ns1="urn:test">
        <return xsi:type="xsd:hexBinary">ABC</return>
      </ns1:testResponse>
    </SOAP-ENV:Body>
  </SOAP-ENV:Envelope>
  XML;
      }
  }

  $client = new TestSoapClient(null, [
      'location' => 'test://',
      'uri' => 'urn:test',
      'exceptions' => true,
  ]);

  var_dump(bin2hex($client->test()));
string(2) "ab"

This is in master as a stricter parsing PR

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants