ext/soap: to_zval_array() native stack overflow on cyclic encoded references.

Fix #22984

The array and apache Map decoders never registered the node being
decoded, unlike to_zval_object_ex(), so a child href or enc:ref pointing
back at an enclosing array recursed until the native stack was exhausted.
An empty holder is now registered before the children are converted, and
replaced by the completed value afterwards.

Author: devnexen

ext/soap/php_encoding.c

@@ -380,6 +380,16 @@ static void soap_add_xml_ref(zval *data, xmlNodePtr node)
 	}
 }
 
+static void soap_add_xml_ref_holder(zval *data, xmlNodePtr node)
+{
+	if (SOAP_GLOBAL(ref_map)) {
+		zval holder;
+
+		array_init(&holder);
+		zend_hash_index_update(SOAP_GLOBAL(ref_map), (zend_ulong)node, &holder);
+	}
+}
+
 static xmlNodePtr master_to_xml_int(encodePtr encode, zval *data, int style, xmlNodePtr parent, int check_class_map)
 {
 	xmlNodePtr node = NULL;
@@ -2536,6 +2546,9 @@ static zval *to_zval_array(zval *ret, encodeTypePtr type, xmlNodePtr data)
 
 	ZVAL_NULL(ret);
 	FIND_XML_NULL(data, ret);
+	if (soap_check_xml_ref(ret, data)) {
+		return ret;
+	}
 
 	if (data &&
 	    (attr = get_attribute(data->properties,"arrayType")) &&
@@ -2672,6 +2685,7 @@ static zval *to_zval_array(zval *ret, encodeTypePtr type, xmlNodePtr data)
 	}
 
 	array_init(ret);
+	soap_add_xml_ref_holder(ret, data);
 	trav = data->children;
 	while (trav) {
 		if (trav->type == XML_ELEMENT_NODE) {
@@ -2729,6 +2743,7 @@ static zval *to_zval_array(zval *ret, encodeTypePtr type, xmlNodePtr data)
 	}
 	efree(dims);
 	efree(pos);
+	soap_add_xml_ref(ret, data);
 	return ret;
 }
 
@@ -2798,9 +2813,13 @@ static zval *to_zval_map(zval *ret, encodeTypePtr type, xmlNodePtr data)
 
 	ZVAL_NULL(ret);
 	FIND_XML_NULL(data, ret);
+	if (soap_check_xml_ref(ret, data)) {
+		return ret;
+	}
 
 	if (data && data->children) {
 		array_init(ret);
+		soap_add_xml_ref_holder(ret, data);
 		trav = data->children;
 
 		trav = data->children;
@@ -2830,6 +2849,7 @@ static zval *to_zval_map(zval *ret, encodeTypePtr type, xmlNodePtr data)
 			zval_ptr_dtor(&key);
 		}
 		ENDFOREACH(trav);
+		soap_add_xml_ref(ret, data);
 	} else {
 		ZVAL_NULL(ret);
 	}