From 88834fb6e5f0d43fb7f5a32aec219a050b41c9e5 Mon Sep 17 00:00:00 2001
From: Ilia Alshanetsky <ilia@ilia.ws>
Date: Thu, 16 Jul 2026 07:29:53 -0400
Subject: [PATCH] ext/soap: fix NULL deref on empty Body with SOAPAction (RPC)

When SoapServer resolves the operation via the SOAPAction header and the
SOAP Body has no element child, func remains NULL. The RPC branch then
did func = func->children and crashed. Guard the children walk so
empty-body requests with a matching SOAPAction are handled safely.
---
 ext/soap/soap.c                           | 12 +++++----
 ext/soap/tests/empty_body_soapaction.phpt | 33 +++++++++++++++++++++++
 2 files changed, 40 insertions(+), 5 deletions(-)
 create mode 100644 ext/soap/tests/empty_body_soapaction.phpt

diff --git a/ext/soap/soap.c b/ext/soap/soap.c
index 2b6a32d3265f..0bbf13a6c282 100644
--- a/ext/soap/soap.c
+++ b/ext/soap/soap.c
@@ -3460,13 +3460,15 @@ static sdlFunctionPtr deserialize_function_call(sdlPtr sdl, xmlDocPtr request, c
 		}
 	}
 
-	if (function && function->binding && function->binding->bindingType == BINDING_SOAP) {
-		sdlSoapBindingFunctionPtr fnb = (sdlSoapBindingFunctionPtr)function->bindingAttributes;
-		if (fnb->style == SOAP_RPC) {
+	if (func != NULL) {
+		if (function && function->binding && function->binding->bindingType == BINDING_SOAP) {
+			sdlSoapBindingFunctionPtr fnb = (sdlSoapBindingFunctionPtr)function->bindingAttributes;
+			if (fnb->style == SOAP_RPC) {
+				func = func->children;
+			}
+		} else {
 			func = func->children;
 		}
-	} else {
-		func = func->children;
 	}
 	deserialize_parameters(func, function, num_params, parameters);
 
diff --git a/ext/soap/tests/empty_body_soapaction.phpt b/ext/soap/tests/empty_body_soapaction.phpt
new file mode 100644
index 000000000000..93102c739c7e
--- /dev/null
+++ b/ext/soap/tests/empty_body_soapaction.phpt
@@ -0,0 +1,33 @@
+--TEST--
+SoapServer: empty Body with SOAPAction must not crash (RPC)
+--EXTENSIONS--
+soap
+--INI--
+soap.wsdl_cache_enabled=0
+--SKIPIF--
+<?php
+if (php_sapi_name() == 'cli') echo 'skip non-CLI SAPI required for --POST-- / php://input';
+?>
+--POST--
+<?xml version="1.0" encoding="UTF-8"?>
+<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
+  <SOAP-ENV:Body/>
+</SOAP-ENV:Envelope>
+--FILE--
+<?php
+class T {
+	function test() {
+		return 'ok';
+	}
+}
+
+$server = new SoapServer(__DIR__ . '/server025.wsdl', [
+	'cache_wsdl' => WSDL_CACHE_NONE,
+]);
+$server->setClass(T::class);
+$_SERVER['HTTP_SOAPACTION'] = '"Test"';
+$server->handle();
+?>
+--EXPECT--
+<?xml version="1.0" encoding="UTF-8"?>
+<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="http://testuri.org"><SOAP-ENV:Body><ns1:testResponse><result>ok</result></ns1:testResponse></SOAP-ENV:Body></SOAP-ENV:Envelope>