archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix SoapFault property destruction

Browse source 
Two issues:
1) We should not modify the object when we pass invalid values
2) We should reset the properties to their default value otherwise we
   get a UAF.

Regressed in df219ccf9d

Closes GH-15248.
This commit is contained in:
Niels Dossche 2024-08-05 20:55:38 +02:00
parent 67ce8759e8
commit 11fbe8801b
No known key found for this signature in database
GPG key ID: B8A8AD166DF0E2E5
3 changed files with 21 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

1
NEWS
View file

@ -45,6 +45,7 @@ PHP NEWS
- Soap: - Soap:
. Fixed bug #55639 (Digest autentication dont work). (nielsdos) . Fixed bug #55639 (Digest autentication dont work). (nielsdos)
. Fix SoapFault property destruction. (nielsdos)
- Standard: - Standard:
. Fix passing non-finite timeout values in stream functions. (nielsdos) . Fix passing non-finite timeout values in stream functions. (nielsdos)

13
ext/soap/soap.c
View file

@ -529,6 +529,13 @@ static void soap_fault_dtor_properties(zval *obj)
zval_ptr_dtor(Z_FAULT_DETAIL_P(obj)); zval_ptr_dtor(Z_FAULT_DETAIL_P(obj));
zval_ptr_dtor(Z_FAULT_NAME_P(obj)); zval_ptr_dtor(Z_FAULT_NAME_P(obj));
zval_ptr_dtor(Z_FAULT_HEADERFAULT_P(obj)); zval_ptr_dtor(Z_FAULT_HEADERFAULT_P(obj));
ZVAL_EMPTY_STRING(Z_FAULT_STRING_P(obj));
ZVAL_NULL(Z_FAULT_CODE_P(obj));
ZVAL_NULL(Z_FAULT_CODENS_P(obj));
ZVAL_NULL(Z_FAULT_ACTOR_P(obj));
ZVAL_NULL(Z_FAULT_DETAIL_P(obj));
ZVAL_NULL(Z_FAULT_NAME_P(obj));
ZVAL_NULL(Z_FAULT_HEADERFAULT_P(obj));
} }
/* {{{ SoapFault constructor */ /* {{{ SoapFault constructor */
@ -550,9 +557,6 @@ PHP_METHOD(SoapFault, __construct)
Z_PARAM_ZVAL_OR_NULL(headerfault) Z_PARAM_ZVAL_OR_NULL(headerfault)
ZEND_PARSE_PARAMETERS_END(); ZEND_PARSE_PARAMETERS_END();
/* Delete previously set properties */
soap_fault_dtor_properties(ZEND_THIS);
if (code_str) { if (code_str) {
fault_code = ZSTR_VAL(code_str); fault_code = ZSTR_VAL(code_str);
fault_code_len = ZSTR_LEN(code_str); fault_code_len = ZSTR_LEN(code_str);
@ -571,6 +575,9 @@ PHP_METHOD(SoapFault, __construct)
RETURN_THROWS(); RETURN_THROWS();
} }
/* Delete previously set properties */
soap_fault_dtor_properties(ZEND_THIS);
if (name != NULL && name_len == 0) { if (name != NULL && name_len == 0) {
name = NULL; name = NULL;
} }

10
ext/soap/tests/SoapFault/gh14586.phpt
View file

@ -6,7 +6,17 @@ soap
<?php <?php
$sf = new SoapFault(null, "x"); $sf = new SoapFault(null, "x");
$sf->__construct(null, "x"); $sf->__construct(null, "x");
try {
$sf->__construct("", "");
} catch (ValueError) {}
$sf->__construct(null, "x", headerFault: []);
var_dump($sf->headerfault);
$sf->__construct(null, "x");
var_dump($sf->headerfault);
?> ?>
DONE DONE
--EXPECT-- --EXPECT--
array(0) {
}
NULL
DONE DONE