Skip to content

Commit f733ee1

Browse files
smalyshevcarusogabriel
smalyshev
authored and
carusogabriel
committed
Fix bug #80672 - Null Dereference in SoapClient
1 parent 5070a0f commit f733ee1

File tree

5 files changed

+40
-15
lines changed

5 files changed

+40
-15
lines changed

‎NEWS‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,9 @@ PHP NEWS
6969
. Reverted fix for bug #76813 (Access violation near NULL on source operand).
7070
(cmb)
7171

72+
- SOAP:
73+
. Fixed bug #80672 (Null Dereference in SoapClient). (CVE-2021-21702) (cmb, Stas)
74+
7275
07 Jan 2021, PHP 8.0.1
7376

7477
- Core:
@@ -543,4 +546,3 @@ PHP NEWS
543546
. Fixed bug #71417 (fread() does not report zlib.inflate errors). (cmb)
544547
. Fixed bug #78792 (zlib.output_compression disabled by Content-Type: image/).
545548
(cmb)
546-

‎ext/soap/php_sdl.c‎

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -313,6 +313,8 @@ void sdl_restore_uri_credentials(sdlCtx *ctx)
313313
ctx->context = NULL;
314314
}
315315

316+
#define SAFE_STR(a) ((a)?a:"")
317+
316318
static void load_wsdl_ex(zval *this_ptr, char *struri, sdlCtx *ctx, int include)
317319
{
318320
sdlPtr tmpsdl = ctx->sdl;
@@ -374,7 +376,7 @@ static void load_wsdl_ex(zval *this_ptr, char *struri, sdlCtx *ctx, int include)
374376
if (node_is_equal_ex(trav2, "schema", XSD_NAMESPACE)) {
375377
load_schema(ctx, trav2);
376378
} else if (is_wsdl_element(trav2) && !node_is_equal(trav2,"documentation")) {
377-
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav2->name);
379+
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav2->name));
378380
}
379381
trav2 = trav2->next;
380382
}
@@ -435,7 +437,7 @@ static void load_wsdl_ex(zval *this_ptr, char *struri, sdlCtx *ctx, int include)
435437
soap_error0(E_ERROR, "Parsing WSDL: <service> has no name attribute");
436438
}
437439
} else if (!node_is_equal(trav,"documentation")) {
438-
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav->name);
440+
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav->name));
439441
}
440442
trav = trav->next;
441443
}
@@ -545,7 +547,7 @@ static sdlSoapBindingFunctionHeaderPtr wsdl_soap_binding_header(sdlCtx* ctx, xml
545547
}
546548
smart_str_free(&key);
547549
} else if (is_wsdl_element(trav) && !node_is_equal(trav,"documentation")) {
548-
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav->name);
550+
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav->name));
549551
}
550552
trav = trav->next;
551553
}
@@ -647,7 +649,7 @@ static void wsdl_soap_binding_body(sdlCtx* ctx, xmlNodePtr node, char* wsdl_soap
647649
}
648650
smart_str_free(&key);
649651
} else if (is_wsdl_element(trav) && !node_is_equal(trav,"documentation")) {
650-
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav->name);
652+
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav->name));
651653
}
652654
trav = trav->next;
653655
}
@@ -679,14 +681,14 @@ static HashTable* wsdl_message(sdlCtx *ctx, xmlChar* message_name)
679681
sdlParamPtr param;
680682

681683
if (trav->ns != NULL && strcmp((char*)trav->ns->href, WSDL_NAMESPACE) != 0) {
682-
soap_error1(E_ERROR, "Parsing WSDL: Unexpected extensibility element <%s>", trav->name);
684+
soap_error1(E_ERROR, "Parsing WSDL: Unexpected extensibility element <%s>", SAFE_STR(trav->name));
683685
}
684686
if (node_is_equal(trav,"documentation")) {
685687
trav = trav->next;
686688
continue;
687689
}
688690
if (!node_is_equal(trav,"part")) {
689-
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav->name);
691+
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav->name));
690692
}
691693
part = trav;
692694
param = emalloc(sizeof(sdlParam));
@@ -695,7 +697,7 @@ static HashTable* wsdl_message(sdlCtx *ctx, xmlChar* message_name)
695697

696698
name = get_attribute(part->properties, "name");
697699
if (name == NULL) {
698-
soap_error1(E_ERROR, "Parsing WSDL: No name associated with <part> '%s'", message->name);
700+
soap_error1(E_ERROR, "Parsing WSDL: No name associated with <part> '%s'", SAFE_STR(message->name));
699701
}
700702

701703
param->paramName = estrdup((char*)name->children->content);
@@ -766,7 +768,7 @@ static sdlPtr load_wsdl(zval *this_ptr, char *struri)
766768
continue;
767769
}
768770
if (!node_is_equal(trav,"port")) {
769-
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav->name);
771+
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav->name));
770772
}
771773

772774
port = trav;
@@ -805,7 +807,7 @@ static sdlPtr load_wsdl(zval *this_ptr, char *struri)
805807
}
806808
}
807809
if (trav2 != address && is_wsdl_element(trav2) && !node_is_equal(trav2,"documentation")) {
808-
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav2->name);
810+
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav2->name));
809811
}
810812
trav2 = trav2->next;
811813
}
@@ -907,7 +909,7 @@ static sdlPtr load_wsdl(zval *this_ptr, char *struri)
907909
continue;
908910
}
909911
if (!node_is_equal(trav2,"operation")) {
910-
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav2->name);
912+
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav2->name));
911913
}
912914

913915
operation = trav2;
@@ -926,7 +928,7 @@ static sdlPtr load_wsdl(zval *this_ptr, char *struri)
926928
!node_is_equal(trav3,"output") &&
927929
!node_is_equal(trav3,"fault") &&
928930
!node_is_equal(trav3,"documentation")) {
929-
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav3->name);
931+
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav3->name));
930932
}
931933
trav3 = trav3->next;
932934
}
@@ -1104,7 +1106,7 @@ static sdlPtr load_wsdl(zval *this_ptr, char *struri)
11041106
}
11051107
}
11061108
} else if (is_wsdl_element(trav) && !node_is_equal(trav,"documentation")) {
1107-
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav->name);
1109+
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav->name));
11081110
}
11091111
trav = trav->next;
11101112
}

‎ext/soap/php_xml.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -197,7 +197,7 @@ xmlNsPtr node_find_ns(xmlNodePtr node)
197197

198198
int attr_is_equal_ex(xmlAttrPtr node, char *name, char *ns)
199199
{
200-
if (name == NULL || strcmp((char*)node->name, name) == 0) {
200+
if (name == NULL || ((node->name) && strcmp((char*)node->name, name) == 0)) {
201201
if (ns) {
202202
xmlNsPtr nsPtr = attr_find_ns(node);
203203
if (nsPtr) {
@@ -213,7 +213,7 @@ int attr_is_equal_ex(xmlAttrPtr node, char *name, char *ns)
213213

214214
int node_is_equal_ex(xmlNodePtr node, char *name, char *ns)
215215
{
216-
if (name == NULL || strcmp((char*)node->name, name) == 0) {
216+
if (name == NULL || ((node->name) && strcmp((char*)node->name, name) == 0)) {
217217
if (ns) {
218218
xmlNsPtr nsPtr = node_find_ns(node);
219219
if (nsPtr) {

‎ext/soap/tests/bug80672.phpt‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
--TEST--
2+
Bug #80672 Null Dereference in SoapClient
3+
--SKIPIF--
4+
<?php require_once('skipif.inc'); ?>
5+
--FILE--
6+
<?php
7+
try {
8+
$client = new SoapClient(__DIR__ . "/bug80672.xml");
9+
$query = $soap->query(array('sXML' => 'something'));
10+
} catch(SoapFault $e) {
11+
print $e->getMessage();
12+
}
13+
?>
14+
--EXPECTF--
15+
SOAP-ERROR: Parsing WSDL: Unexpected WSDL element <>

‎ext/soap/tests/bug80672.xml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
<?xml version="1.0" encoding="ISO-8859-1"?>
2+
<soap:definitions xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
3+
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
4+
xmlns:soap="http://schemas.xmlsoap.org/wsdl/">
5+
<![CDATA[test]]>
6+
</soap:definitions>

0 commit comments

Comments
 (0)