Fix CVE-2010-0397: null pointer dereference when processing invalid XML-RPC

requests (bug #51288)

diff --git a/NEWS b/NEWS
index f11fd95af04133bd6489de766a6918eae5979b67..22ecee8398f34be8698130730d292416b68628f9 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,9 @@ PHP                                                                        NEWS
 ?? ??? 2010, PHP 5.2.14
 - Updated timezone database to version 2010.3. (Derick)
 
+- Fixed a NULL pointer dereference when processing invalid XML-RPC
+  requests (Fixes CVE-2010-0397, bug #51288). (Raphael Geissert)
+
 - Fixed bug #51269 (zlib.output_compression Overwrites Vary Header). (Adam)
 - Fixed bug #51237 (milter SAPI crash on startup). (igmar at palsenberg dot com)
 - Fixed bug #51213 (pdo_mssql is trimming value of the money column). (Ilia,

diff --git a/ext/xmlrpc/tests/bug51288.phpt b/ext/xmlrpc/tests/bug51288.phpt
new file mode 100644 (file)
index 0000000..d9bdef8
--- /dev/null
+++ b/ext/xmlrpc/tests/bug51288.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #51288 (CVE-2010-0397, NULL pointer deref when no <methodName> in request)
+--FILE--
+<?php
+$method = NULL;
+$req = '<?xml version="1.0"?><methodCall></methodCall>';
+var_dump(xmlrpc_decode_request($req, $method));
+var_dump($method);
+echo "Done\n";
+?>
+--EXPECT--
+NULL
+NULL
+Done

diff --git a/ext/xmlrpc/xmlrpc-epi-php.c b/ext/xmlrpc/xmlrpc-epi-php.c
index c4680000a7b65ccb0f6082c8728ec2a7eb626385..980be7b81703c060819f7f0c32d4a5bc96622ee9 100644 (file)
--- a/ext/xmlrpc/xmlrpc-epi-php.c
+++ b/ext/xmlrpc/xmlrpc-epi-php.c
@@ -723,6 +723,7 @@ zval* decode_request_worker (zval* xml_in, zval* encoding_in, zval* method_name_
        zval* retval = NULL;
        XMLRPC_REQUEST response;
        STRUCT_XMLRPC_REQUEST_INPUT_OPTIONS opts = {{0}};
+       const char *method_name;
        opts.xml_elem_opts.encoding = encoding_in ? utf8_get_encoding_id_from_string(Z_STRVAL_P(encoding_in)) : ENCODING_DEFAULT;
 
        /* generate XMLRPC_REQUEST from raw xml */
@@ -733,10 +734,15 @@ zval* decode_request_worker (zval* xml_in, zval* encoding_in, zval* method_name_
 
                if(XMLRPC_RequestGetRequestType(response) == xmlrpc_request_call) {
                        if(method_name_out) {
-                               zval_dtor(method_name_out);
-                               Z_TYPE_P(method_name_out) = IS_STRING;
-                               Z_STRVAL_P(method_name_out) = estrdup(XMLRPC_RequestGetMethodName(response));
-                               Z_STRLEN_P(method_name_out) = strlen(Z_STRVAL_P(method_name_out));
+                               method_name = XMLRPC_RequestGetMethodName(response);
+                               if (method_name) {
+                                       zval_dtor(method_name_out);
+                                       Z_TYPE_P(method_name_out) = IS_STRING;
+                                       Z_STRVAL_P(method_name_out) = estrdup(method_name);
+                                       Z_STRLEN_P(method_name_out) = strlen(Z_STRVAL_P(method_name_out));
+                               } else {
+                                       retval = NULL;
+                               }
                        }
                }