BUGFIX: HTTP chunked transfer-encoding support

1 files changed, 28 insertions, 13 deletions

diff --git a/ext/soap/php_http.c b/ext/soap/php_http.c
index df6355d240..aa57ce8a8b 100644
--- a/ext/soap/php_http.c
+++ b/ext/soap/php_http.c
@@ -642,26 +642,41 @@ static int get_http_body(php_stream *stream, char *headers,  char **response, in
 	content_length = get_http_header_value(headers, "Content-Length: ");
 
 	if (trans_enc && !strcmp(trans_enc, "chunked")) {
-		int buf_size = 0, len_size;
 		char done, chunk_size[10];
 
 		done = FALSE;
 		http_buf = NULL;
 
 		while (!done) {
-			php_stream_gets(stream, chunk_size, sizeof(chunk_size));
-
-			if (sscanf(chunk_size, "%x", &buf_size) != -1) {
-				http_buf = erealloc(http_buf, http_buf_size + buf_size + 1);
-				len_size = 0;
-
-				while (http_buf_size < buf_size) {
-					len_size += php_stream_read(stream, http_buf + http_buf_size, buf_size - len_size);
-					http_buf_size += len_size;
-				}
-
+			int buf_size = 0;
+
+			php_stream_gets(stream, chunk_size, sizeof(chunk_size));		
+			if (sscanf(chunk_size, "%x", &buf_size) > 0 ) {
+				if (buf_size > 0) {
+					int len_size = 0;
+		
+					http_buf = erealloc(http_buf, http_buf_size + buf_size + 1);
+
+					while (len_size < buf_size) {
+						int len_read = php_stream_read(stream, http_buf + http_buf_size, buf_size - len_size);
+						if (len_read <= 0) {
+							/* Error or EOF */
+							done = TRUE;
+						  break;
+						}
+						len_size += len_read;
+	 					http_buf_size += len_size;
+ 					}
+ 				}
+				
 				/* Eat up '\r' '\n' */
-				php_stream_getc(stream);php_stream_getc(stream);
+				php_stream_getc(stream);
+				php_stream_getc(stream);
+			} else {				
+				/* Somthing wrong in chunked encoding */
+				efree(trans_enc);
+				efree(http_buf);
+				return FALSE;
 			}
 			if (buf_size == 0) {
 				done = TRUE;