Blame SOURCES/php-5.6.5-bug69085.patch

4c9102
Single patch merged from
4c9102
4c9102
From 997b7e56302710bb3db00b56d0629ac75d73a207 Mon Sep 17 00:00:00 2001
4c9102
From: Xinchen Hui <laruence@php.net>
4c9102
Date: Fri, 27 Feb 2015 23:32:32 +0800
4c9102
Subject: [PATCH] Fixed bug #69085 (SoapClient's __call() type confusion
4c9102
 through unserialize()).
4c9102
4c9102
From 0c136a2abd49298b66acb0cad504f0f972f5bfe8 Mon Sep 17 00:00:00 2001
4c9102
From: Dmitry Stogov <dmitry@zend.com>
4c9102
Date: Tue, 3 Mar 2015 09:44:46 +0300
4c9102
Subject: [PATCH] Added type checks
4c9102
4c9102
From c8eaca013a3922e8383def6158ece2b63f6ec483 Mon Sep 17 00:00:00 2001
4c9102
From: Dmitry Stogov <dmitry@zend.com>
4c9102
Date: Tue, 3 Mar 2015 10:43:48 +0300
4c9102
Subject: [PATCH] Added type checks
4c9102
4c9102
From 76c1ec5e96640e3076c105bde2cccfceb7557690 Mon Sep 17 00:00:00 2001
4c9102
From: Xinchen Hui <laruence@php.net>
4c9102
Date: Wed, 25 Mar 2015 12:07:25 +0800
4c9102
Subject: [PATCH] Bug #69293	NEW segfault when using
4c9102
 SoapClient::__setSoapHeader (bisected, regression)
4c9102
4c9102
From c61ceef7796b3967dd5e270245d33ba72ba055ee Mon Sep 17 00:00:00 2001
4c9102
From: Remi Collet <remi@php.net>
4c9102
Date: Mon, 13 Apr 2015 14:39:11 +0200
4c9102
Subject: [PATCH] fix type in fix for #69085
4c9102
4c9102
diff -I Copyright -up a/ext/soap/php_encoding.c ext/soap/php_encoding.c
4c9102
--- a/ext/soap/php_encoding.c	2015-01-21 01:40:37.000000000 +0100
4c9102
+++ b/ext/soap/php_encoding.c	2015-04-15 14:03:43.585454281 +0200
4c9102
@@ -402,12 +402,15 @@ static xmlNodePtr master_to_xml_int(enco
4c9102
 		encodePtr enc = NULL;
4c9102
 		HashTable *ht = Z_OBJPROP_P(data);
4c9102
 
4c9102
-		if (zend_hash_find(ht, "enc_type", sizeof("enc_type"), (void **)&ztype) == FAILURE) {
4c9102
+		if (zend_hash_find(ht, "enc_type", sizeof("enc_type"), (void **)&ztype) == FAILURE ||
4c9102
+		    Z_TYPE_PP(ztype) != IS_LONG) {
4c9102
 			soap_error0(E_ERROR, "Encoding: SoapVar has no 'enc_type' property");
4c9102
 		}
4c9102
 
4c9102
-		if (zend_hash_find(ht, "enc_stype", sizeof("enc_stype"), (void **)&zstype) == SUCCESS) {
4c9102
-			if (zend_hash_find(ht, "enc_ns", sizeof("enc_ns"), (void **)&zns) == SUCCESS) {
4c9102
+		if (zend_hash_find(ht, "enc_stype", sizeof("enc_stype"), (void **)&zstype) == SUCCESS &&
4c9102
+		    Z_TYPE_PP(zstype) == IS_STRING) {
4c9102
+			if (zend_hash_find(ht, "enc_ns", sizeof("enc_ns"), (void **)&zns) == SUCCESS &&
4c9102
+			    Z_TYPE_PP(zns) == IS_STRING) {
4c9102
 				enc = get_encoder(SOAP_GLOBAL(sdl), Z_STRVAL_PP(zns), Z_STRVAL_PP(zstype));
4c9102
 			} else {
4c9102
 				zns = NULL;
4c9102
@@ -443,8 +446,10 @@ static xmlNodePtr master_to_xml_int(enco
4c9102
 		}
4c9102
 
4c9102
 		if (style == SOAP_ENCODED || (SOAP_GLOBAL(sdl) && encode != enc)) {
4c9102
-			if (zend_hash_find(ht, "enc_stype", sizeof("enc_stype"), (void **)&zstype) == SUCCESS) {
4c9102
-				if (zend_hash_find(ht, "enc_ns", sizeof("enc_ns"), (void **)&zns) == SUCCESS) {
4c9102
+			if (zend_hash_find(ht, "enc_stype", sizeof("enc_stype"), (void **)&zstype) == SUCCESS &&
4c9102
+			    Z_TYPE_PP(zstype) == IS_STRING) {
4c9102
+				if (zend_hash_find(ht, "enc_ns", sizeof("enc_ns"), (void **)&zns) == SUCCESS &&
4c9102
+				    Z_TYPE_PP(zns) == IS_STRING) {
4c9102
 					set_ns_and_type_ex(node, Z_STRVAL_PP(zns), Z_STRVAL_PP(zstype));
4c9102
 				} else {
4c9102
 					set_ns_and_type_ex(node, NULL, Z_STRVAL_PP(zstype));
4c9102
@@ -452,10 +457,12 @@ static xmlNodePtr master_to_xml_int(enco
4c9102
 			}
4c9102
 		}
4c9102
 
4c9102
-		if (zend_hash_find(ht, "enc_name", sizeof("enc_name"), (void **)&zname) == SUCCESS) {
4c9102
+		if (zend_hash_find(ht, "enc_name", sizeof("enc_name"), (void **)&zname) == SUCCESS &&
4c9102
+		    Z_TYPE_PP(zname) == IS_STRING) {
4c9102
 			xmlNodeSetName(node, BAD_CAST(Z_STRVAL_PP(zname)));
4c9102
 		}
4c9102
-		if (zend_hash_find(ht, "enc_namens", sizeof("enc_namens"), (void **)&znamens) == SUCCESS) {
4c9102
+		if (zend_hash_find(ht, "enc_namens", sizeof("enc_namens"), (void **)&znamens) == SUCCESS &&
4c9102
+		    Z_TYPE_PP(znamens) == IS_STRING) {
4c9102
 			xmlNsPtr nsp = encode_add_ns(node, Z_STRVAL_PP(znamens));
4c9102
 			xmlSetNs(node, nsp);
4c9102
 		}
4c9102
@@ -3638,18 +3645,21 @@ static encodePtr get_array_type(xmlNodeP
4c9102
 		    Z_OBJCE_PP(tmp) == soap_var_class_entry) {
4c9102
 			zval **ztype;
4c9102
 
4c9102
-			if (zend_hash_find(Z_OBJPROP_PP(tmp), "enc_type", sizeof("enc_type"), (void **)&ztype) == FAILURE) {
4c9102
+			if (zend_hash_find(Z_OBJPROP_PP(tmp), "enc_type", sizeof("enc_type"), (void **)&ztype) == FAILURE ||
4c9102
+			    Z_TYPE_PP(ztype) != IS_LONG) {
4c9102
 				soap_error0(E_ERROR,  "Encoding: SoapVar has no 'enc_type' property");
4c9102
 			}
4c9102
 			cur_type = Z_LVAL_PP(ztype);
4c9102
 
4c9102
-			if (zend_hash_find(Z_OBJPROP_PP(tmp), "enc_stype", sizeof("enc_stype"), (void **)&ztype) == SUCCESS) {
4c9102
+			if (zend_hash_find(Z_OBJPROP_PP(tmp), "enc_stype", sizeof("enc_stype"), (void **)&ztype) == SUCCESS &&
4c9102
+			    Z_TYPE_PP(ztype) == IS_STRING) {
4c9102
 				cur_stype = Z_STRVAL_PP(ztype);
4c9102
 			} else {
4c9102
 				cur_stype = NULL;
4c9102
 			}
4c9102
 
4c9102
-			if (zend_hash_find(Z_OBJPROP_PP(tmp), "enc_ns", sizeof("enc_ns"), (void **)&ztype) == SUCCESS) {
4c9102
+			if (zend_hash_find(Z_OBJPROP_PP(tmp), "enc_ns", sizeof("enc_ns"), (void **)&ztype) == SUCCESS &&
4c9102
+			    Z_TYPE_PP(ztype) == IS_STRING) {
4c9102
 				cur_ns = Z_STRVAL_PP(ztype);
4c9102
 			} else {
4c9102
 				cur_ns = NULL;
4c9102
diff -I Copyright -up a/ext/soap/php_http.c ext/soap/php_http.c
4c9102
--- a/ext/soap/php_http.c	2015-01-21 01:40:37.000000000 +0100
4c9102
+++ b/ext/soap/php_http.c	2015-04-15 14:03:43.586454288 +0200
4c9102
@@ -36,14 +36,16 @@ int proxy_authentication(zval* this_ptr,
4c9102
 {
4c9102
 	zval **login, **password;
4c9102
 
4c9102
-	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_proxy_login", sizeof("_proxy_login"), (void **)&login) == SUCCESS) {
4c9102
+	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_proxy_login", sizeof("_proxy_login"), (void **)&login) == SUCCESS &&
4c9102
+	    Z_TYPE_PP(login) == IS_STRING) {
4c9102
 		unsigned char* buf;
4c9102
 		int len;
4c9102
 		smart_str auth = {0};
4c9102
 
4c9102
 		smart_str_appendl(&auth, Z_STRVAL_PP(login), Z_STRLEN_PP(login));
4c9102
 		smart_str_appendc(&auth, ':');
4c9102
-		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_proxy_password", sizeof("_proxy_password"), (void **)&password) == SUCCESS) {
4c9102
+		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_proxy_password", sizeof("_proxy_password"), (void **)&password) == SUCCESS &&
4c9102
+		    Z_TYPE_PP(password) == IS_STRING) {
4c9102
 			smart_str_appendl(&auth, Z_STRVAL_PP(password), Z_STRLEN_PP(password));
4c9102
 		}
4c9102
 		smart_str_0(&auth);
4c9102
@@ -64,14 +66,16 @@ int basic_authentication(zval* this_ptr,
4c9102
 	zval **login, **password;
4c9102
 
4c9102
 	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_login", sizeof("_login"), (void **)&login) == SUCCESS &&
4c9102
-			!zend_hash_exists(Z_OBJPROP_P(this_ptr), "_digest", sizeof("_digest"))) {
4c9102
+	    Z_TYPE_PP(login) == IS_STRING &&
4c9102
+	    !zend_hash_exists(Z_OBJPROP_P(this_ptr), "_digest", sizeof("_digest"))) {
4c9102
 		unsigned char* buf;
4c9102
 		int len;
4c9102
 		smart_str auth = {0};
4c9102
 
4c9102
 		smart_str_appendl(&auth, Z_STRVAL_PP(login), Z_STRLEN_PP(login));
4c9102
 		smart_str_appendc(&auth, ':');
4c9102
-		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_password", sizeof("_password"), (void **)&password) == SUCCESS) {
4c9102
+		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_password", sizeof("_password"), (void **)&password) == SUCCESS &&
4c9102
+		    Z_TYPE_PP(password) == IS_STRING) {
4c9102
 			smart_str_appendl(&auth, Z_STRVAL_PP(password), Z_STRLEN_PP(password));
4c9102
 		}
4c9102
 		smart_str_0(&auth);
4c9102
@@ -571,6 +575,7 @@ try_again:
4c9102
 		}
4c9102
 		if (!http_1_1 ||
4c9102
 			(zend_hash_find(Z_OBJPROP_P(this_ptr), "_keep_alive", sizeof("_keep_alive"), (void **)&tmp) == SUCCESS &&
4c9102
+			 (Z_TYPE_PP(tmp) == IS_BOOL || Z_TYPE_PP(tmp) == IS_LONG) &&
4c9102
 			 Z_LVAL_PP(tmp) == 0)) {
4c9102
 			smart_str_append_const(&soap_headers, "\r\n"
4c9102
 				"Connection: close\r\n");
4c9102
@@ -804,7 +809,8 @@ try_again:
4c9102
 		}
4c9102
 
4c9102
 		/* Send cookies along with request */
4c9102
-		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_cookies", sizeof("_cookies"), (void **)&cookies) == SUCCESS) {
4c9102
+		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_cookies", sizeof("_cookies"), (void **)&cookies) == SUCCESS &&
4c9102
+		    Z_TYPE_PP(cookies) == IS_ARRAY) {
4c9102
 			zval **data;
4c9102
 			char *key;
4c9102
 			uint key_len;
4c9102
@@ -848,7 +854,7 @@ try_again:
4c9102
 		smart_str_append_const(&soap_headers, "\r\n");
4c9102
 		smart_str_0(&soap_headers);
4c9102
 		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "trace", sizeof("trace"), (void **) &trace) == SUCCESS &&
4c9102
-		    Z_LVAL_PP(trace) > 0) {
4c9102
+		    (Z_TYPE_PP(trace) == IS_BOOL || Z_TYPE_PP(trace) == IS_LONG) && Z_LVAL_PP(trace) != 0) {
4c9102
 			add_property_stringl(this_ptr, "__last_request_headers", soap_headers.c, soap_headers.len, 1);
4c9102
 		}
4c9102
 		smart_str_appendl(&soap_headers, request, request_size);
4c9102
@@ -893,7 +899,7 @@ try_again:
4c9102
 		}
4c9102
 
4c9102
 		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "trace", sizeof("trace"), (void **) &trace) == SUCCESS &&
4c9102
-		    Z_LVAL_PP(trace) > 0) {
4c9102
+		    (Z_TYPE_PP(trace) == IS_BOOL || Z_TYPE_PP(trace) == IS_LONG) && Z_LVAL_PP(trace) != 0) {
4c9102
 			add_property_stringl(this_ptr, "__last_response_headers", http_headers, http_header_size, 1);
4c9102
 		}
4c9102
 
4c9102
@@ -942,7 +948,8 @@ try_again:
4c9102
 		char *eqpos, *sempos;
4c9102
 		zval **cookies;
4c9102
 
4c9102
-		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_cookies", sizeof("_cookies"), (void **)&cookies) == FAILURE) {
4c9102
+		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_cookies", sizeof("_cookies"), (void **)&cookies) == FAILURE ||
4c9102
+		    Z_TYPE_PP(cookies) != IS_ARRAY) {
4c9102
 			zval *tmp_cookies;
4c9102
 			MAKE_STD_ZVAL(tmp_cookies);
4c9102
 			array_init(tmp_cookies);
4c9102
diff -I Copyright -up a/ext/soap/soap.c ext/soap/soap.c
4c9102
--- a/ext/soap/soap.c	2015-01-21 01:40:37.000000000 +0100
4c9102
+++ b/ext/soap/soap.c	2015-04-15 14:03:43.592454334 +0200
4c9102
@@ -932,6 +932,12 @@ PHP_METHOD(SoapFault, __toString)
4c9102
 
4c9102
 	zend_call_function(&fci, NULL TSRMLS_CC);
4c9102
 
4c9102
+	convert_to_string(faultcode);
4c9102
+	convert_to_string(faultstring);
4c9102
+	convert_to_string(file);
4c9102
+	convert_to_long(line);
4c9102
+	convert_to_string(trace);
4c9102
+
4c9102
 	len = spprintf(&str, 0, "SoapFault exception: [%s] %s in %s:%ld\nStack trace:\n%s",
4c9102
 	               Z_STRVAL_P(faultcode), Z_STRVAL_P(faultstring), Z_STRVAL_P(file), Z_LVAL_P(line),
4c9102
 	               Z_STRLEN_P(trace) ? Z_STRVAL_P(trace) : "#0 {main}\n");
4c9102
@@ -2070,8 +2076,7 @@ static void soap_server_fault_ex(sdlFunc
4c9102
 
4c9102
 	xmlDocDumpMemory(doc_return, &buf, &size);
4c9102
 
4c9102
-	zend_is_auto_global("_SERVER", sizeof("_SERVER") - 1 TSRMLS_CC);
4c9102
-	if (PG(http_globals)[TRACK_VARS_SERVER] &&
4c9102
+	if ((PG(http_globals)[TRACK_VARS_SERVER] || zend_is_auto_global("_SERVER", sizeof("_SERVER") - 1 TSRMLS_CC)) &&
4c9102
 		zend_hash_find(PG(http_globals)[TRACK_VARS_SERVER]->value.ht, "HTTP_USER_AGENT", sizeof("HTTP_USER_AGENT"), (void **) &agent_name) == SUCCESS &&
4c9102
 		Z_TYPE_PP(agent_name) == IS_STRING) {
4c9102
 		if (strncmp(Z_STRVAL_PP(agent_name), "Shockwave Flash", sizeof("Shockwave Flash")-1) == 0) {
4c9102
@@ -2564,7 +2569,7 @@ static int do_request(zval *this_ptr, xm
4c9102
 	}
4c9102
 
4c9102
 	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "trace", sizeof("trace"), (void **) &trace) == SUCCESS &&
4c9102
-	    Z_LVAL_PP(trace) > 0) {
4c9102
+	    (Z_TYPE_PP(trace) == IS_BOOL || Z_TYPE_PP(trace) == IS_LONG) && Z_LVAL_PP(trace) != 0) {
4c9102
 		add_property_stringl(this_ptr, "__last_request", buf, buf_size, 1);
4c9102
 	}
4c9102
 
4c9102
@@ -2599,7 +2604,7 @@ static int do_request(zval *this_ptr, xm
4c9102
 		}
4c9102
 		ret = FALSE;
4c9102
 	} else if (zend_hash_find(Z_OBJPROP_P(this_ptr), "trace", sizeof("trace"), (void **) &trace) == SUCCESS &&
4c9102
-	    Z_LVAL_PP(trace) > 0) {
4c9102
+	           (Z_TYPE_PP(trace) == IS_BOOL || Z_TYPE_PP(trace) == IS_LONG) && Z_LVAL_PP(trace) != 0) {
4c9102
 		add_property_stringl(this_ptr, "__last_response", Z_STRVAL_P(response), Z_STRLEN_P(response), 1);
4c9102
 	}
4c9102
 	zval_ptr_dtor(&params[4]);
4c9102
@@ -2643,13 +2648,13 @@ static void do_soap_call(zval* this_ptr,
4c9102
 
4c9102
 	SOAP_CLIENT_BEGIN_CODE();
4c9102
 
4c9102
-	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "trace", sizeof("trace"), (void **) &trace) == SUCCESS
4c9102
-		&& Z_LVAL_PP(trace) > 0) {
4c9102
+	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "trace", sizeof("trace"), (void **) &trace) == SUCCESS &&
4c9102
+	    (Z_TYPE_PP(trace) == IS_BOOL || Z_TYPE_PP(trace) == IS_LONG) && Z_LVAL_PP(trace) != 0) {
4c9102
 		zend_hash_del(Z_OBJPROP_P(this_ptr), "__last_request", sizeof("__last_request"));
4c9102
 		zend_hash_del(Z_OBJPROP_P(this_ptr), "__last_response", sizeof("__last_response"));
4c9102
 	}
4c9102
-	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_soap_version", sizeof("_soap_version"), (void **) &tmp) == SUCCESS
4c9102
-		&& Z_LVAL_PP(tmp) == SOAP_1_2) {
4c9102
+	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_soap_version", sizeof("_soap_version"), (void **) &tmp) == SUCCESS &&
4c9102
+		Z_TYPE_PP(tmp) == IS_LONG && Z_LVAL_PP(tmp) == SOAP_1_2) {
4c9102
 		soap_version = SOAP_1_2;
4c9102
 	} else {
4c9102
 		soap_version = SOAP_1_1;
4c9102
@@ -2746,7 +2751,7 @@ static void do_soap_call(zval* this_ptr,
4c9102
 			zval **uri;
4c9102
 			smart_str action = {0};
4c9102
 
4c9102
-			if (zend_hash_find(Z_OBJPROP_P(this_ptr), "uri", sizeof("uri"), (void *)&uri) == FAILURE) {
4c9102
+			if (zend_hash_find(Z_OBJPROP_P(this_ptr), "uri", sizeof("uri"), (void *)&uri) == FAILURE || Z_TYPE_PP(uri) != IS_STRING) {
4c9102
 				add_soap_fault(this_ptr, "Client", "Error finding \"uri\" property", NULL, NULL TSRMLS_CC);
4c9102
 			} else if (location == NULL) {
4c9102
 				add_soap_fault(this_ptr, "Client", "Error could not find \"location\" property", NULL, NULL TSRMLS_CC);
4c9102
@@ -2904,7 +2909,7 @@ PHP_METHOD(SoapClient, __call)
4c9102
 	}
4c9102
 
4c9102
 	/* Add default headers */
4c9102
-	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "__default_headers", sizeof("__default_headers"), (void **) &tmp)==SUCCESS) {
4c9102
+	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "__default_headers", sizeof("__default_headers"), (void **) &tmp) == SUCCESS && Z_TYPE_PP(tmp) == IS_ARRAY) {
4c9102
 		HashTable *default_headers = Z_ARRVAL_P(*tmp);
4c9102
 		if (soap_headers) {
4c9102
 			if (!free_soap_headers) {
4c9102
@@ -3025,7 +3030,8 @@ PHP_METHOD(SoapClient, __getLastRequest)
4c9102
 		return;
4c9102
 	}
4c9102
 
4c9102
-	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "__last_request", sizeof("__last_request"), (void **)&tmp) == SUCCESS) {
4c9102
+	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "__last_request", sizeof("__last_request"), (void **)&tmp) == SUCCESS &&
4c9102
+	    Z_TYPE_PP(tmp) == IS_STRING) {
4c9102
 		RETURN_STRINGL(Z_STRVAL_PP(tmp), Z_STRLEN_PP(tmp), 1);
4c9102
 	}
4c9102
 	RETURN_NULL();
4c9102
@@ -3043,7 +3049,8 @@ PHP_METHOD(SoapClient, __getLastResponse
4c9102
 		return;
4c9102
 	}
4c9102
 	
4c9102
-	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "__last_response", sizeof("__last_response"), (void **)&tmp) == SUCCESS) {
4c9102
+	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "__last_response", sizeof("__last_response"), (void **)&tmp) == SUCCESS &&
4c9102
+	    Z_TYPE_PP(tmp) == IS_STRING) {
4c9102
 		RETURN_STRINGL(Z_STRVAL_PP(tmp), Z_STRLEN_PP(tmp), 1);
4c9102
 	}
4c9102
 	RETURN_NULL();
4c9102
@@ -3061,7 +3068,8 @@ PHP_METHOD(SoapClient, __getLastRequestH
4c9102
 		return;
4c9102
 	}
4c9102
 	
4c9102
-	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "__last_request_headers", sizeof("__last_request_headers"), (void **)&tmp) == SUCCESS) {
4c9102
+	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "__last_request_headers", sizeof("__last_request_headers"), (void **)&tmp) == SUCCESS &&
4c9102
+	    Z_TYPE_PP(tmp) == IS_STRING) {
4c9102
 		RETURN_STRINGL(Z_STRVAL_PP(tmp), Z_STRLEN_PP(tmp), 1);
4c9102
 	}
4c9102
 	RETURN_NULL();
4c9102
@@ -3079,7 +3087,8 @@ PHP_METHOD(SoapClient, __getLastResponse
4c9102
 		return;
4c9102
 	}
4c9102
 
4c9102
-	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "__last_response_headers", sizeof("__last_response_headers"), (void **)&tmp) == SUCCESS) {
4c9102
+	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "__last_response_headers", sizeof("__last_response_headers"), (void **)&tmp) == SUCCESS &&
4c9102
+	    Z_TYPE_PP(tmp) == IS_STRING) {
4c9102
 		RETURN_STRINGL(Z_STRVAL_PP(tmp), Z_STRLEN_PP(tmp), 1);
4c9102
 	}
4c9102
 	RETURN_NULL();
4c9102
@@ -3135,13 +3144,15 @@ PHP_METHOD(SoapClient, __setCookie)
4c9102
 	}
4c9102
 
4c9102
 	if (val == NULL) {
4c9102
-		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_cookies", sizeof("_cookies"), (void **)&cookies) == SUCCESS) {
4c9102
+		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_cookies", sizeof("_cookies"), (void **)&cookies) == SUCCESS &&
4c9102
+		    Z_TYPE_PP(cookies) == IS_ARRAY) {
4c9102
 			zend_hash_del(Z_ARRVAL_PP(cookies), name, name_len+1);
4c9102
 		}
4c9102
 	} else {
4c9102
 		zval *zcookie;
4c9102
 
4c9102
-		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_cookies", sizeof("_cookies"), (void **)&cookies) == FAILURE) {
4c9102
+		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_cookies", sizeof("_cookies"), (void **)&cookies) == FAILURE ||
4c9102
+		    Z_TYPE_PP(cookies) != IS_ARRAY) {
4c9102
 			zval *tmp_cookies;
4c9102
 
4c9102
 			MAKE_STD_ZVAL(tmp_cookies);
4c9102
@@ -3169,7 +3180,8 @@ PHP_METHOD(SoapClient, __getCookies)
4c9102
 
4c9102
 	array_init(return_value);
4c9102
 
4c9102
-	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_cookies", sizeof("_cookies"), (void **)&cookies) != FAILURE) {
4c9102
+	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_cookies", sizeof("_cookies"), (void **)&cookies) != FAILURE &&
4c9102
+	    Z_TYPE_PP(cookies) == IS_ARRAY) {
4c9102
 		zend_hash_copy(Z_ARRVAL_P(return_value), Z_ARRVAL_P(*cookies), (copy_ctor_func_t) zval_add_ref, (void *)&tmp, sizeof(zval*));
4c9102
 	}
4c9102
 }
4c9102
@@ -3991,7 +4003,8 @@ static xmlDocPtr serialize_response_call
4c9102
 		}
4c9102
 
4c9102
 		if (version == SOAP_1_1) {
4c9102
-			if (zend_hash_find(prop, "faultcode", sizeof("faultcode"), (void**)&tmp) == SUCCESS) {
4c9102
+			if (zend_hash_find(prop, "faultcode", sizeof("faultcode"), (void**)&tmp) == SUCCESS &&
4c9102
+			    Z_TYPE_PP(tmp) == IS_STRING) {
4c9102
 				size_t new_len;
4c9102
 				xmlNodePtr node = xmlNewNode(NULL, BAD_CAST("faultcode"));
4c9102
 				char *str = php_escape_html_entities((unsigned char*)Z_STRVAL_PP(tmp), Z_STRLEN_PP(tmp), &new_len, 0, 0, NULL TSRMLS_CC);
4c9102
@@ -4004,7 +4017,7 @@ static xmlDocPtr serialize_response_call
4c9102
 				} else {	
4c9102
 					xmlNodeSetContentLen(node, BAD_CAST(str), (int)new_len);
4c9102
 				}
4c9102
-				efree(str);
4c9102
+				str_efree(str);
4c9102
 			}
4c9102
 			if (zend_hash_find(prop, "faultstring", sizeof("faultstring"), (void**)&tmp) == SUCCESS) {
4c9102
 				xmlNodePtr node = master_to_xml(get_conversion(IS_STRING), *tmp, SOAP_LITERAL, param TSRMLS_CC);
4c9102
@@ -4016,7 +4029,8 @@ static xmlDocPtr serialize_response_call
4c9102
 			}
4c9102
 			detail_name = "detail";
4c9102
 		} else {
4c9102
-			if (zend_hash_find(prop, "faultcode", sizeof("faultcode"), (void**)&tmp) == SUCCESS) {
4c9102
+			if (zend_hash_find(prop, "faultcode", sizeof("faultcode"), (void**)&tmp) == SUCCESS &&
4c9102
+			    Z_TYPE_PP(tmp) == IS_STRING) {
4c9102
 				size_t new_len;
4c9102
 				xmlNodePtr node = xmlNewChild(param, ns, BAD_CAST("Code"), NULL);
4c9102
 				char *str = php_escape_html_entities((unsigned char*)Z_STRVAL_PP(tmp), Z_STRLEN_PP(tmp), &new_len, 0, 0, NULL TSRMLS_CC);
4c9102
@@ -4029,7 +4043,7 @@ static xmlDocPtr serialize_response_call
4c9102
 				} else {	
4c9102
 					xmlNodeSetContentLen(node, BAD_CAST(str), (int)new_len);
4c9102
 				}
4c9102
-				efree(str);
4c9102
+				str_efree(str);
4c9102
 			}
4c9102
 			if (zend_hash_find(prop, "faultstring", sizeof("faultstring"), (void**)&tmp) == SUCCESS) {
4c9102
 				xmlNodePtr node = xmlNewChild(param, ns, BAD_CAST("Reason"), NULL);
4c9102
@@ -4256,7 +4270,8 @@ static xmlDocPtr serialize_function_call
4c9102
 			}
4c9102
 		}
4c9102
 	} else {
4c9102
-		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "style", sizeof("style"), (void **)&zstyle) == SUCCESS) {
4c9102
+		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "style", sizeof("style"), (void **)&zstyle) == SUCCESS &&
4c9102
+		    Z_TYPE_PP(zstyle) == IS_LONG) {
4c9102
 			style = Z_LVAL_PP(zstyle);
4c9102
 		} else {
4c9102
 			style = SOAP_RPC;
4c9102
@@ -4279,7 +4294,7 @@ static xmlDocPtr serialize_function_call
4c9102
 		}
4c9102
 
4c9102
 		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "use", sizeof("use"), (void **)&zuse) == SUCCESS &&
4c9102
-			  Z_LVAL_PP(zuse) == SOAP_LITERAL) {
4c9102
+		    Z_TYPE_PP(zuse) == IS_LONG && Z_LVAL_PP(zuse) == SOAP_LITERAL) {
4c9102
 			use = SOAP_LITERAL;
4c9102
 		} else {
4c9102
 			use = SOAP_ENCODED;
4c9102
@@ -4409,6 +4424,7 @@ static xmlNodePtr serialize_parameter(sd
4c9102
 		zval **param_data;
4c9102
 
4c9102
 		if (zend_hash_find(Z_OBJPROP_P(param_val), "param_name", sizeof("param_name"), (void **)&param_name) == SUCCESS &&
4c9102
+		    Z_TYPE_PP(param_name) == IS_STRING &&
4c9102
 		    zend_hash_find(Z_OBJPROP_P(param_val), "param_data", sizeof("param_data"), (void **)&param_data) == SUCCESS) {
4c9102
 			param_val = *param_data;
4c9102
 			name = Z_STRVAL_PP(param_name);
4c9102
diff --git a/ext/soap/tests/bugs/bug69085.phpt b/ext/soap/tests/bugs/bug69085.phpt
4c9102
new file mode 100644
4c9102
index 0000000..cb27cfd
4c9102
--- /dev/null
4c9102
+++ b/ext/soap/tests/bugs/bug69085.phpt
4c9102
@@ -0,0 +1,17 @@
4c9102
+--TEST--
4c9102
+Bug #69085 (SoapClient's __call() type confusion through unserialize())
4c9102
+--SKIPIF--
4c9102
+
4c9102
+--INI--
4c9102
+soap.wsdl_cache_enabled=0
4c9102
+--FILE--
4c9102
+
4c9102
+
4c9102
+$dummy = unserialize('O:10:"SoapClient":5:{s:3:"uri";s:1:"a";s:8:"location";s:22:"http://localhost/a.xml";s:17:"__default_headers";i:1337;s:15:"__last_response";s:1:"a";s:5:"trace";s:1:"x";}');
4c9102
+try {
4c9102
+	$dummy->whatever();
4c9102
+} catch (Exception $e) {
4c9102
+	echo "okey";
4c9102
+}
4c9102
+--EXPECT--
4c9102
+okey