Skip to content

Commit

Permalink
Fix #78173: XML-RPC mutates immutable objects during encoding
Browse files Browse the repository at this point in the history
With opcache.protect_memory=1 enabled, the XML-RPC extension causes a
segfault on PHP 7.2 as it is modifying the recursion counter of objects
it touches, without first checking if they are immutable or not.

This doesn't affect 7.3+
  • Loading branch information
asherkin authored and cmb69 committed Jun 18, 2019
1 parent e59b986 commit d54220b
Show file tree
Hide file tree
Showing 2 changed files with 6 additions and 3 deletions.
3 changes: 3 additions & 0 deletions NEWS
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,9 @@ PHP NEWS
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
?? ??? 2019, PHP 7.2.21

- XMLRPC:
. Fixed #78173 (XML-RPC mutates immutable objects during encoding). (Asher
Baker)

27 Jun 2019, PHP 7.2.20

Expand Down
6 changes: 3 additions & 3 deletions ext/xmlrpc/xmlrpc-epi-php.c
Original file line number Diff line number Diff line change
Expand Up @@ -556,7 +556,7 @@ static XMLRPC_VALUE PHP_to_XMLRPC_worker (const char* key, zval* in_val, int dep
XMLRPC_VECTOR_TYPE vtype;

ht = HASH_OF(&val);
if (ht && ht->u.v.nApplyCount > 1) {
if (ht && ZEND_HASH_APPLY_PROTECTION(ht) && ht->u.v.nApplyCount > 1) {
zend_throw_error(NULL, "XML-RPC doesn't support circular references");
return NULL;
}
Expand All @@ -570,7 +570,7 @@ static XMLRPC_VALUE PHP_to_XMLRPC_worker (const char* key, zval* in_val, int dep
ZEND_HASH_FOREACH_KEY_VAL(Z_ARRVAL(val_arr), num_index, my_key, pIter) {
ZVAL_DEREF(pIter);
ht = HASH_OF(pIter);
if (ht) {
if (ht && ZEND_HASH_APPLY_PROTECTION(ht)) {
ht->u.v.nApplyCount++;
}
if (my_key == NULL) {
Expand All @@ -587,7 +587,7 @@ static XMLRPC_VALUE PHP_to_XMLRPC_worker (const char* key, zval* in_val, int dep
} else {
XMLRPC_AddValueToVector(xReturn, PHP_to_XMLRPC_worker(ZSTR_VAL(my_key), pIter, depth++));
}
if (ht) {
if (ht && ZEND_HASH_APPLY_PROTECTION(ht)) {
ht->u.v.nApplyCount--;
}
} ZEND_HASH_FOREACH_END();
Expand Down

0 comments on commit d54220b

Please sign in to comment.