Fix bug #80672 - Null Dereference in SoapClient

diff --git a/NEWS b/NEWS
index 0eaaec8f89dbbdcd7bb7684c3a2e15456f55fdb9..9b9486c99a3d740869de9e42f4c5de5ba72a1563 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,9 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 7.3.27
 
+- SOAP:
+  . Fixed bug #80672 (Null Dereference in SoapClient). (CVE-2021-21702) (cmb, Stas)
+
 
 07 Jan 2021, PHP 7.3.26
 

diff --git a/ext/soap/php_sdl.c b/ext/soap/php_sdl.c
index 1875bec41dc5b01599a1efe9ce68461f522be256..67ab4097c2d7a7a58c5aea9ef0c9edbca8349695 100644 (file)
--- a/ext/soap/php_sdl.c
+++ b/ext/soap/php_sdl.c
@@ -313,6 +313,8 @@ void sdl_restore_uri_credentials(sdlCtx *ctx)
        ctx->context = NULL;
 }
 
+#define SAFE_STR(a) ((a)?a:"")
+
 static void load_wsdl_ex(zval *this_ptr, char *struri, sdlCtx *ctx, int include)
 {
        sdlPtr tmpsdl = ctx->sdl;
@@ -374,7 +376,7 @@ static void load_wsdl_ex(zval *this_ptr, char *struri, sdlCtx *ctx, int include)
                                if (node_is_equal_ex(trav2, "schema", XSD_NAMESPACE)) {
                                        load_schema(ctx, trav2);
                                } else if (is_wsdl_element(trav2) && !node_is_equal(trav2,"documentation")) {
-                                       soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav2->name);
+                                       soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav2->name));
                                }
                                trav2 = trav2->next;
                        }
@@ -435,7 +437,7 @@ static void load_wsdl_ex(zval *this_ptr, char *struri, sdlCtx *ctx, int include)
                                soap_error0(E_ERROR, "Parsing WSDL: <service> has no name attribute");
                        }
                } else if (!node_is_equal(trav,"documentation")) {
-                       soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav->name);
+                       soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>",  SAFE_STR(trav->name));
                }
                trav = trav->next;
        }
@@ -545,7 +547,7 @@ static sdlSoapBindingFunctionHeaderPtr wsdl_soap_binding_header(sdlCtx* ctx, xml
                                }
                                smart_str_free(&key);
                        } else if (is_wsdl_element(trav) && !node_is_equal(trav,"documentation")) {
-                               soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav->name);
+                               soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>",  SAFE_STR(trav->name));
                        }
                        trav = trav->next;
                }
@@ -647,7 +649,7 @@ static void wsdl_soap_binding_body(sdlCtx* ctx, xmlNodePtr node, char* wsdl_soap
                        }
                        smart_str_free(&key);
                } else if (is_wsdl_element(trav) && !node_is_equal(trav,"documentation")) {
-                       soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav->name);
+                       soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>",  SAFE_STR(trav->name));
                }
                trav = trav->next;
        }
@@ -679,14 +681,14 @@ static HashTable* wsdl_message(sdlCtx *ctx, xmlChar* message_name)
                sdlParamPtr param;
 
                if (trav->ns != NULL && strcmp((char*)trav->ns->href, WSDL_NAMESPACE) != 0) {
-                       soap_error1(E_ERROR, "Parsing WSDL: Unexpected extensibility element <%s>", trav->name);
+                       soap_error1(E_ERROR, "Parsing WSDL: Unexpected extensibility element <%s>",  SAFE_STR(trav->name));
                }
                if (node_is_equal(trav,"documentation")) {
                        trav = trav->next;
                        continue;
                }
                if (!node_is_equal(trav,"part")) {
-                       soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav->name);
+                       soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>",  SAFE_STR(trav->name));
                }
                part = trav;
                param = emalloc(sizeof(sdlParam));
@@ -695,7 +697,7 @@ static HashTable* wsdl_message(sdlCtx *ctx, xmlChar* message_name)
 
                name = get_attribute(part->properties, "name");
                if (name == NULL) {
-                       soap_error1(E_ERROR, "Parsing WSDL: No name associated with <part> '%s'", message->name);
+                       soap_error1(E_ERROR, "Parsing WSDL: No name associated with <part> '%s'",  SAFE_STR(message->name));
                }
 
                param->paramName = estrdup((char*)name->children->content);
@@ -764,7 +766,7 @@ static sdlPtr load_wsdl(zval *this_ptr, char *struri)
                                        continue;
                                }
                                if (!node_is_equal(trav,"port")) {
-                                       soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav->name);
+                                       soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>",  SAFE_STR(trav->name));
                                }
 
                                port = trav;
@@ -803,7 +805,7 @@ static sdlPtr load_wsdl(zval *this_ptr, char *struri)
                                                }
                                        }
                                        if (trav2 != address && is_wsdl_element(trav2) && !node_is_equal(trav2,"documentation")) {
-                                               soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav2->name);
+                                               soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>",  SAFE_STR(trav2->name));
                                        }
                                  trav2 = trav2->next;
                                }
@@ -905,7 +907,7 @@ static sdlPtr load_wsdl(zval *this_ptr, char *struri)
                                                continue;
                                        }
                                        if (!node_is_equal(trav2,"operation")) {
-                                               soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav2->name);
+                                               soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>",  SAFE_STR(trav2->name));
                                        }
 
                                        operation = trav2;
@@ -924,7 +926,7 @@ static sdlPtr load_wsdl(zval *this_ptr, char *struri)
                                                           !node_is_equal(trav3,"output") &&
                                                           !node_is_equal(trav3,"fault") &&
                                                           !node_is_equal(trav3,"documentation")) {
-                                                       soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav3->name);
+                                                       soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>",  SAFE_STR(trav3->name));
                                                }
                                                trav3 = trav3->next;
                                        }
@@ -1102,7 +1104,7 @@ static sdlPtr load_wsdl(zval *this_ptr, char *struri)
                                                                                                }
                                                                                        }
                                                                                } else if (is_wsdl_element(trav) && !node_is_equal(trav,"documentation")) {
-                                                                                       soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav->name);
+                                                                                       soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>",  SAFE_STR(trav->name));
                                                                                }
                                                                                trav = trav->next;
                                                                        }

diff --git a/ext/soap/php_xml.c b/ext/soap/php_xml.c
index 8d07bb0d832347c98c9a331199b3816b5d2a4fe3..a1ab525de35056ff4a2908bd49a2c03e4cff4550 100644 (file)
--- a/ext/soap/php_xml.c
+++ b/ext/soap/php_xml.c
@@ -203,7 +203,7 @@ xmlNsPtr node_find_ns(xmlNodePtr node)
 
 int attr_is_equal_ex(xmlAttrPtr node, char *name, char *ns)
 {
-       if (name == NULL || strcmp((char*)node->name, name) == 0) {
+       if (name == NULL || ((node->name) && strcmp((char*)node->name, name) == 0)) {
                if (ns) {
                        xmlNsPtr nsPtr = attr_find_ns(node);
                        if (nsPtr) {
@@ -219,7 +219,7 @@ int attr_is_equal_ex(xmlAttrPtr node, char *name, char *ns)
 
 int node_is_equal_ex(xmlNodePtr node, char *name, char *ns)
 {
-       if (name == NULL || strcmp((char*)node->name, name) == 0) {
+       if (name == NULL || ((node->name) && strcmp((char*)node->name, name) == 0)) {
                if (ns) {
                        xmlNsPtr nsPtr = node_find_ns(node);
                        if (nsPtr) {

diff --git a/ext/soap/tests/bug80672.phpt b/ext/soap/tests/bug80672.phpt
new file mode 100644 (file)
index 0000000..71e2b1d
--- /dev/null
+++ b/ext/soap/tests/bug80672.phpt
@@ -0,0 +1,15 @@
+--TEST--
+Bug #80672 Null Dereference in SoapClient
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+try {
+    $client = new SoapClient(__DIR__ . "/bug80672.xml");
+    $query = $soap->query(array('sXML' => 'something'));
+} catch(SoapFault $e) {
+    print $e->getMessage();
+}
+?>
+--EXPECTF--
+SOAP-ERROR: Parsing WSDL: Unexpected WSDL element <>
\ No newline at end of file

diff --git a/ext/soap/tests/bug80672.xml b/ext/soap/tests/bug80672.xml
new file mode 100644 (file)
index 0000000..0fa185b
--- /dev/null
+++ b/ext/soap/tests/bug80672.xml
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<soap:definitions xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xmlns:xsd="http://www.w3.org/2001/XMLSchema"
+  xmlns:soap="http://schemas.xmlsoap.org/wsdl/">
+<![CDATA[test]]>
+</soap:definitions>