Fix bug #71711

Also handle another case of bug #71996.

4 files changed, 34 insertions, 3 deletions

diff --git a/NEWS b/NEWS
index 37daabe74a..b8478c7766 100644
--- a/NEWS
+++ b/NEWS
@@ -6,6 +6,7 @@ PHP                                                                        NEWS
   . Fixed bug #66797 (mb_substr only takes 32-bit signed integer). (cmb)
 
 - SOAP:
+  . Fixed bug #71711 (Soap Server Member variables reference bug). (Nikita)
   . Fixed bug #71996 (Using references in arrays doesn't work like expected).
     (Nikita)
 
diff --git a/ext/soap/php_encoding.c b/ext/soap/php_encoding.c
index 9c9e4e9e56..10d59ad576 100644
--- a/ext/soap/php_encoding.c
+++ b/ext/soap/php_encoding.c
@@ -1963,7 +1963,7 @@ static xmlNodePtr to_xml_object(encodeTypePtr type, zval *data, int style, xmlNo
 			xmlNodePtr property;
 
 			ZEND_HASH_FOREACH_STR_KEY_VAL_IND(prop, str_key, zprop) {
-
+				ZVAL_DEREF(zprop);
 				property = master_to_xml(get_conversion(Z_TYPE_P(zprop)), zprop, style, xmlParam);
 
 				if (str_key) {
@@ -2684,7 +2684,6 @@ static xmlNodePtr to_xml_map(encodeTypePtr type, zval *data, int style, xmlNodeP
 
 	if (Z_TYPE_P(data) == IS_ARRAY) {
 		ZEND_HASH_FOREACH_KEY_VAL_IND(Z_ARRVAL_P(data), int_val, key_val, temp_data) {
-
 			item = xmlNewNode(NULL, BAD_CAST("item"));
 			xmlAddChild(xmlParam, item);
 			key = xmlNewNode(NULL, BAD_CAST("key"));
@@ -2707,6 +2706,7 @@ static xmlNodePtr to_xml_map(encodeTypePtr type, zval *data, int style, xmlNodeP
 				smart_str_free(&tmp);
 			}
 
+			ZVAL_DEREF(temp_data);
 			xparam = master_to_xml(get_conversion(Z_TYPE_P(temp_data)), temp_data, style, item);
 			xmlNodeSetName(xparam, BAD_CAST("value"));
 		} ZEND_HASH_FOREACH_END();
diff --git a/ext/soap/tests/bug71711.phpt b/ext/soap/tests/bug71711.phpt
new file mode 100644
index 0000000000..ec3930c6a5
--- /dev/null
+++ b/ext/soap/tests/bug71711.phpt
@@ -0,0 +1,22 @@
+--TEST--
+Bug #71711: Soap Server Member variables reference bug
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+
+$client = new class(null, [ 'location' => '', 'uri' => 'http://example.org']) extends SoapClient {
+    public function __doRequest($request, $location, $action, $version, $one_way = 0) {
+        echo $request;
+        return '';
+    }
+};
+$ref = array("foo");
+$data = new stdClass;
+$data->prop =& $ref;
+$client->foo($data);
+
+?>
+--EXPECT--
+<?xml version="1.0" encoding="UTF-8"?>
+<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="http://example.org" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><ns1:foo><param0 xsi:type="SOAP-ENC:Struct"><prop SOAP-ENC:arrayType="xsd:string[1]" xsi:type="SOAP-ENC:Array"><item xsi:type="xsd:string">foo</item></prop></param0></ns1:foo></SOAP-ENV:Body></SOAP-ENV:Envelope>
diff --git a/ext/soap/tests/bug71996.phpt b/ext/soap/tests/bug71996.phpt
index c4bb092b22..9f341fbc5e 100644
--- a/ext/soap/tests/bug71996.phpt
+++ b/ext/soap/tests/bug71996.phpt
@@ -7,15 +7,23 @@ Bug #71996: Using references in arrays doesn't work like expected
 
 $client = new class(null, ['location' => '', 'uri' => 'http://example.org']) extends SoapClient {
     public function __doRequest($request, $location, $action, $version, $one_way = 0) {
-        echo $request;
+        echo $request, "\n";
         return '';
     }
 };
+
 $ref = array("foo");
 $data = array(&$ref);
 $client->foo($data);
 
+$ref = array("def" => "foo");
+$data = array("abc" => &$ref);
+$client->foo($data);
+
 ?>
 --EXPECT--
 <?xml version="1.0" encoding="UTF-8"?>
 <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="http://example.org" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><ns1:foo><param0 SOAP-ENC:arrayType="SOAP-ENC:Array[1]" xsi:type="SOAP-ENC:Array"><item SOAP-ENC:arrayType="xsd:string[1]" xsi:type="SOAP-ENC:Array"><item xsi:type="xsd:string">foo</item></item></param0></ns1:foo></SOAP-ENV:Body></SOAP-ENV:Envelope>
+
+<?xml version="1.0" encoding="UTF-8"?>
+<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="http://example.org" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:ns2="http://xml.apache.org/xml-soap" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><ns1:foo><param0 xsi:type="ns2:Map"><item><key xsi:type="xsd:string">abc</key><value xsi:type="ns2:Map"><item><key xsi:type="xsd:string">def</key><value xsi:type="xsd:string">foo</value></item></value></item></param0></ns1:foo></SOAP-ENV:Body></SOAP-ENV:Envelope>