Skip to content

Commit 3c939e3

Browse files
smalyshevsmalyshev
committed
Fix bug #80672 - Null Dereference in SoapClient
1 parent 9c67308 commit 3c939e3

File tree

5 files changed

+40
-14
lines changed

5 files changed

+40
-14
lines changed

‎NEWS

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@ PHP NEWS
22
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
33
?? ??? ????, PHP 7.3.27
44

5+
- SOAP:
6+
. Fixed bug #80672 (Null Dereference in SoapClient). (CVE-2021-21702) (cmb, Stas)
7+
58

69
07 Jan 2021, PHP 7.3.26
710

‎ext/soap/php_sdl.c

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -313,6 +313,8 @@ void sdl_restore_uri_credentials(sdlCtx *ctx)
313313
ctx->context = NULL;
314314
}
315315

316+
#define SAFE_STR(a) ((a)?a:"")
317+
316318
static void load_wsdl_ex(zval *this_ptr, char *struri, sdlCtx *ctx, int include)
317319
{
318320
sdlPtr tmpsdl = ctx->sdl;
@@ -374,7 +376,7 @@ static void load_wsdl_ex(zval *this_ptr, char *struri, sdlCtx *ctx, int include)
374376
if (node_is_equal_ex(trav2, "schema", XSD_NAMESPACE)) {
375377
load_schema(ctx, trav2);
376378
} else if (is_wsdl_element(trav2) && !node_is_equal(trav2,"documentation")) {
377-
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav2->name);
379+
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav2->name));
378380
}
379381
trav2 = trav2->next;
380382
}
@@ -435,7 +437,7 @@ static void load_wsdl_ex(zval *this_ptr, char *struri, sdlCtx *ctx, int include)
435437
soap_error0(E_ERROR, "Parsing WSDL: <service> has no name attribute");
436438
}
437439
} else if (!node_is_equal(trav,"documentation")) {
438-
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav->name);
440+
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav->name));
439441
}
440442
trav = trav->next;
441443
}
@@ -545,7 +547,7 @@ static sdlSoapBindingFunctionHeaderPtr wsdl_soap_binding_header(sdlCtx* ctx, xml
545547
}
546548
smart_str_free(&key);
547549
} else if (is_wsdl_element(trav) && !node_is_equal(trav,"documentation")) {
548-
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav->name);
550+
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav->name));
549551
}
550552
trav = trav->next;
551553
}
@@ -647,7 +649,7 @@ static void wsdl_soap_binding_body(sdlCtx* ctx, xmlNodePtr node, char* wsdl_soap
647649
}
648650
smart_str_free(&key);
649651
} else if (is_wsdl_element(trav) && !node_is_equal(trav,"documentation")) {
650-
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav->name);
652+
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav->name));
651653
}
652654
trav = trav->next;
653655
}
@@ -679,14 +681,14 @@ static HashTable* wsdl_message(sdlCtx *ctx, xmlChar* message_name)
679681
sdlParamPtr param;
680682

681683
if (trav->ns != NULL && strcmp((char*)trav->ns->href, WSDL_NAMESPACE) != 0) {
682-
soap_error1(E_ERROR, "Parsing WSDL: Unexpected extensibility element <%s>", trav->name);
684+
soap_error1(E_ERROR, "Parsing WSDL: Unexpected extensibility element <%s>", SAFE_STR(trav->name));
683685
}
684686
if (node_is_equal(trav,"documentation")) {
685687
trav = trav->next;
686688
continue;
687689
}
688690
if (!node_is_equal(trav,"part")) {
689-
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav->name);
691+
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav->name));
690692
}
691693
part = trav;
692694
param = emalloc(sizeof(sdlParam));
@@ -695,7 +697,7 @@ static HashTable* wsdl_message(sdlCtx *ctx, xmlChar* message_name)
695697

696698
name = get_attribute(part->properties, "name");
697699
if (name == NULL) {
698-
soap_error1(E_ERROR, "Parsing WSDL: No name associated with <part> '%s'", message->name);
700+
soap_error1(E_ERROR, "Parsing WSDL: No name associated with <part> '%s'", SAFE_STR(message->name));
699701
}
700702

701703
param->paramName = estrdup((char*)name->children->content);
@@ -764,7 +766,7 @@ static sdlPtr load_wsdl(zval *this_ptr, char *struri)
764766
continue;
765767
}
766768
if (!node_is_equal(trav,"port")) {
767-
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav->name);
769+
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav->name));
768770
}
769771

770772
port = trav;
@@ -803,7 +805,7 @@ static sdlPtr load_wsdl(zval *this_ptr, char *struri)
803805
}
804806
}
805807
if (trav2 != address && is_wsdl_element(trav2) && !node_is_equal(trav2,"documentation")) {
806-
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav2->name);
808+
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav2->name));
807809
}
808810
trav2 = trav2->next;
809811
}
@@ -905,7 +907,7 @@ static sdlPtr load_wsdl(zval *this_ptr, char *struri)
905907
continue;
906908
}
907909
if (!node_is_equal(trav2,"operation")) {
908-
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav2->name);
910+
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav2->name));
909911
}
910912

911913
operation = trav2;
@@ -924,7 +926,7 @@ static sdlPtr load_wsdl(zval *this_ptr, char *struri)
924926
!node_is_equal(trav3,"output") &&
925927
!node_is_equal(trav3,"fault") &&
926928
!node_is_equal(trav3,"documentation")) {
927-
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav3->name);
929+
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav3->name));
928930
}
929931
trav3 = trav3->next;
930932
}
@@ -1102,7 +1104,7 @@ static sdlPtr load_wsdl(zval *this_ptr, char *struri)
11021104
}
11031105
}
11041106
} else if (is_wsdl_element(trav) && !node_is_equal(trav,"documentation")) {
1105-
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav->name);
1107+
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav->name));
11061108
}
11071109
trav = trav->next;
11081110
}

‎ext/soap/php_xml.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -203,7 +203,7 @@ xmlNsPtr node_find_ns(xmlNodePtr node)
203203

204204
int attr_is_equal_ex(xmlAttrPtr node, char *name, char *ns)
205205
{
206-
if (name == NULL || strcmp((char*)node->name, name) == 0) {
206+
if (name == NULL || ((node->name) && strcmp((char*)node->name, name) == 0)) {
207207
if (ns) {
208208
xmlNsPtr nsPtr = attr_find_ns(node);
209209
if (nsPtr) {
@@ -219,7 +219,7 @@ int attr_is_equal_ex(xmlAttrPtr node, char *name, char *ns)
219219

220220
int node_is_equal_ex(xmlNodePtr node, char *name, char *ns)
221221
{
222-
if (name == NULL || strcmp((char*)node->name, name) == 0) {
222+
if (name == NULL || ((node->name) && strcmp((char*)node->name, name) == 0)) {
223223
if (ns) {
224224
xmlNsPtr nsPtr = node_find_ns(node);
225225
if (nsPtr) {

‎ext/soap/tests/bug80672.phpt

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
--TEST--
2+
Bug #80672 Null Dereference in SoapClient
3+
--SKIPIF--
4+
<?php require_once('skipif.inc'); ?>
5+
--FILE--
6+
<?php
7+
try {
8+
$client = new SoapClient(__DIR__ . "/bug80672.xml");
9+
$query = $soap->query(array('sXML' => 'something'));
10+
} catch(SoapFault $e) {
11+
print $e->getMessage();
12+
}
13+
?>
14+
--EXPECTF--
15+
SOAP-ERROR: Parsing WSDL: Unexpected WSDL element <>

‎ext/soap/tests/bug80672.xml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
<?xml version="1.0" encoding="ISO-8859-1"?>
2+
<soap:definitions xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
3+
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
4+
xmlns:soap="http://schemas.xmlsoap.org/wsdl/">
5+
<![CDATA[test]]>
6+
</soap:definitions>

0 commit comments

Comments
 (0)