archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix bug #70951: Segmentation fault on invalid WSDL cache

Browse source 
We mix in the endianness and the zend_long size to make sure cache files
can't be used on incompatible architectures.

Closes GH-18707.
This commit is contained in:
Niels Dossche 2025-05-29 22:13:43 +02:00
parent 90a9fb59ce
commit 56abb316eb
No known key found for this signature in database
GPG key ID: B8A8AD166DF0E2E5
2 changed files with 11 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
NEWS
View file

@ -186,6 +186,7 @@ PHP NEWS
header is correct). (nielsdos) header is correct). (nielsdos)
. Fix namespace handling of WSDL and XML schema in SOAP, . Fix namespace handling of WSDL and XML schema in SOAP,
fixing at least GH-16320 and bug #68576. (nielsdos) fixing at least GH-16320 and bug #68576. (nielsdos)
. Fixed bug #70951 (Segmentation fault on invalid WSDL cache). (nielsdos)
- Sockets: - Sockets:
. Added IPPROTO_ICMP/IPPROTO_ICMPV6 to create raw socket for ICMP usage. . Added IPPROTO_ICMP/IPPROTO_ICMPV6 to create raw socket for ICMP usage.

10
ext/soap/php_sdl.c
View file

@ -31,6 +31,12 @@
# define O_BINARY 0 # define O_BINARY 0
#endif #endif
#ifdef WORDS_BIGENDIAN
# define SOAP_BIG_ENDIAN 1
#else
# define SOAP_BIG_ENDIAN 0
#endif
static void delete_fault(zval *zv); static void delete_fault(zval *zv);
static void delete_fault_persistent(zval *zv); static void delete_fault_persistent(zval *zv);
static void delete_binding(zval *zv); static void delete_binding(zval *zv);
@ -3188,9 +3194,13 @@ sdlPtr get_sdl(zval *this_ptr, char *uri, zend_long cache_wsdl)
char *user = php_get_current_user(); char *user = php_get_current_user();
size_t user_len = user ? strlen(user) + 1 : 0; size_t user_len = user ? strlen(user) + 1 : 0;
/* System architecture identification (see bug #70951) */
static const char ids[] = {SIZEOF_ZEND_LONG, SOAP_BIG_ENDIAN};
md5str[0] = '\0'; md5str[0] = '\0';
PHP_MD5Init(&md5_context); PHP_MD5Init(&md5_context);
PHP_MD5Update(&md5_context, (unsigned char*)uri, uri_len); PHP_MD5Update(&md5_context, (unsigned char*)uri, uri_len);
PHP_MD5Update(&md5_context, ids, sizeof(ids));
PHP_MD5Final(digest, &md5_context); PHP_MD5Final(digest, &md5_context);
make_digest(md5str, digest); make_digest(md5str, digest);
key = emalloc(len+sizeof("/wsdl-")-1+user_len+2+sizeof(md5str)); key = emalloc(len+sizeof("/wsdl-")-1+user_len+2+sizeof(md5str));