From: Raphael Geissert <geissert@php.net>
Date: Sat, 13 Mar 2010 18:40:29 +0000 (+0000)
Subject: Fix CVE-2010-0397: null pointer dereference when processing invalid XML-RPC
X-Git-Tag: php-5.4.0alpha1~191^2~1865
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=907dae8b21fcbc3979b3a9f206f10f506e452537;p=php

Fix CVE-2010-0397: null pointer dereference when processing invalid XML-RPC
requests (bug #51288)
---

diff --git a/ext/xmlrpc/tests/bug51288.phpt b/ext/xmlrpc/tests/bug51288.phpt
new file mode 100644
index 0000000000..d9bdef822e
--- /dev/null
+++ b/ext/xmlrpc/tests/bug51288.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #51288 (CVE-2010-0397, NULL pointer deref when no <methodName> in request)
+--FILE--
+<?php
+$method = NULL;
+$req = '<?xml version="1.0"?><methodCall></methodCall>';
+var_dump(xmlrpc_decode_request($req, $method));
+var_dump($method);
+echo "Done\n";
+?>
+--EXPECT--
+NULL
+NULL
+Done
diff --git a/ext/xmlrpc/xmlrpc-epi-php.c b/ext/xmlrpc/xmlrpc-epi-php.c
index e41d8c2353..256076070d 100644
--- a/ext/xmlrpc/xmlrpc-epi-php.c
+++ b/ext/xmlrpc/xmlrpc-epi-php.c
@@ -784,6 +784,7 @@ zval* decode_request_worker(char *xml_in, int xml_in_len, char *encoding_in, zva
 	zval* retval = NULL;
 	XMLRPC_REQUEST response;
 	STRUCT_XMLRPC_REQUEST_INPUT_OPTIONS opts = {{0}};
+	const char *method_name;
 	opts.xml_elem_opts.encoding = encoding_in ? utf8_get_encoding_id_from_string(encoding_in) : ENCODING_DEFAULT;
 
 	/* generate XMLRPC_REQUEST from raw xml */
@@ -794,10 +795,15 @@ zval* decode_request_worker(char *xml_in, int xml_in_len, char *encoding_in, zva
 
 		if (XMLRPC_RequestGetRequestType(response) == xmlrpc_request_call) {
 			if (method_name_out) {
-				zval_dtor(method_name_out);
-				Z_TYPE_P(method_name_out) = IS_STRING;
-				Z_STRVAL_P(method_name_out) = estrdup(XMLRPC_RequestGetMethodName(response));
-				Z_STRLEN_P(method_name_out) = strlen(Z_STRVAL_P(method_name_out));
+				method_name = XMLRPC_RequestGetMethodName(response);
+				if (method_name) {
+					zval_dtor(method_name_out);
+					Z_TYPE_P(method_name_out) = IS_STRING;
+					Z_STRVAL_P(method_name_out) = estrdup(method_name);
+					Z_STRLEN_P(method_name_out) = strlen(Z_STRVAL_P(method_name_out));
+				} else {
+					retval = NULL;
+				}
 			}
 		}