Use heap-allocated return value

ext/soap/soap.c

@@ -1407,7 +1407,7 @@ PHP_METHOD(SoapServer, handle)
 	sdlPtr old_sdl = NULL;
 	soapServicePtr service;
 	xmlDocPtr doc_request=NULL, doc_return;
-	zval function_name, **params, *soap_obj, retval;
+	zval function_name, **params, *soap_obj, *retval;
 	char *fn_name, cont_len[30];
 	int num_params = 0, size, i, call_status = 0;
 	xmlChar *buf;
@@ -1427,7 +1427,6 @@ PHP_METHOD(SoapServer, handle)
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|s", &arg, &arg_len) == FAILURE) {
 		php_error_docref(NULL TSRMLS_CC, E_ERROR, "Invalid parameters");
 	}
-	INIT_ZVAL(retval);
 
 	if (SG(request_info).request_method &&
 	    strcmp(SG(request_info).request_method, "GET") == 0 &&
@@ -1477,6 +1476,8 @@ PHP_METHOD(SoapServer, handle)
 		}
 	}
 
+	ALLOC_INIT_ZVAL(retval);
+
 	if (php_start_ob_buffer(NULL, 0, 0 TSRMLS_CC) != SUCCESS) {
 		php_error_docref(NULL TSRMLS_CC, E_ERROR,"ob_start failed");
 	}
@@ -1494,7 +1495,7 @@ PHP_METHOD(SoapServer, handle)
 			    Z_TYPE_PP(encoding) == IS_STRING) {
 				zval func;
 				zval retval;
-			  zval param;
+				zval param;
 				zval *params[1];
 
 				if ((strcmp(Z_STRVAL_PP(encoding),"gzip") == 0 ||
@@ -1761,7 +1762,7 @@ PHP_METHOD(SoapServer, handle)
 	    ((service->type == SOAP_CLASS || service->type == SOAP_OBJECT) &&
 	     zend_hash_exists(function_table, ZEND_CALL_FUNC_NAME, sizeof(ZEND_CALL_FUNC_NAME)))) {
 		if (service->type == SOAP_CLASS || service->type == SOAP_OBJECT) {
-			call_status = call_user_function(NULL, &soap_obj, &function_name, &retval, num_params, params TSRMLS_CC);
+			call_status = call_user_function(NULL, &soap_obj, &function_name, retval, num_params, params TSRMLS_CC);
 			if (service->type == SOAP_CLASS) {
 #if HAVE_PHP_SESSION && !defined(COMPILE_DL_SESSION)
 				if (service->soap_class.persistance != SOAP_PERSISTENCE_SESSION) {
@@ -1774,7 +1775,7 @@ PHP_METHOD(SoapServer, handle)
 #endif
 			}
 		} else {
-			call_status = call_user_function(EG(function_table), NULL, &function_name, &retval, num_params, params TSRMLS_CC);
+			call_status = call_user_function(EG(function_table), NULL, &function_name, retval, num_params, params TSRMLS_CC);
 		}
 	} else {
 		php_error(E_ERROR, "Function '%s' doesn't exist", Z_STRVAL(function_name));
@@ -1803,10 +1804,10 @@ PHP_METHOD(SoapServer, handle)
 	if (call_status == SUCCESS) {
 		char *response_name;
 
-		if (Z_TYPE(retval) == IS_OBJECT &&
-		    instanceof_function(Z_OBJCE(retval), soap_fault_class_entry TSRMLS_CC)) {
+		if (Z_TYPE_P(retval) == IS_OBJECT &&
+		    instanceof_function(Z_OBJCE_P(retval), soap_fault_class_entry TSRMLS_CC)) {
 			php_end_ob_buffer(0, 0 TSRMLS_CC);
-			soap_server_fault_ex(function, &retval, NULL TSRMLS_CC);
+			soap_server_fault_ex(function, retval, NULL TSRMLS_CC);
 			goto fail;
 		}
 
@@ -1817,7 +1818,7 @@ PHP_METHOD(SoapServer, handle)
 			memcpy(response_name,Z_STRVAL(function_name),Z_STRLEN(function_name));
 			memcpy(response_name+Z_STRLEN(function_name),"Response",sizeof("Response"));
 		}
-		doc_return = serialize_response_call(function, response_name, service->uri, &retval, soap_headers, soap_version TSRMLS_CC);
+		doc_return = serialize_response_call(function, response_name, service->uri, retval, soap_headers, soap_version TSRMLS_CC);
 		efree(response_name);
 	} else {
 		php_error_docref(NULL TSRMLS_CC, E_ERROR, "Function '%s' call failed", Z_STRVAL(function_name));
@@ -1907,7 +1908,7 @@ fail:
 	SOAP_GLOBAL(features) = old_features;
 
 	/* Free soap headers */
-	zval_dtor(&retval);
+	zval_ptr_dtor(&retval);
 	while (soap_headers != NULL) {
 		soapHeader *h = soap_headers;
 		int i;