archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 05:58:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fixed #70728

Browse source 
Conflicts:
	ext/xmlrpc/xmlrpc-epi-php.c
This commit is contained in:
Julien Pauli 2015-12-22 14:28:19 +01:00 • committed by Anatol Belski
parent bc4baf608b
commit ef4449a8e8
2 changed files with 40 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

30
ext/xmlrpc/tests/bug70728.phpt Normal file
View file

@ -0,0 +1,30 @@
--TEST--
Bug #70728 (Type Confusion Vulnerability in PHP_to_XMLRPC_worker)
--SKIPIF--
<?php
if (!extension_loaded("xmlrpc")) print "skip";
?>
--FILE--
<?php
$obj = new stdClass;
$obj->xmlrpc_type = 'base64';
$obj->scalar = 0x1122334455;
var_dump(xmlrpc_encode($obj));
var_dump($obj);
?>
--EXPECTF--
string(135) "<?xml version="1.0" encoding="utf-8"?>
<params>
<param>
<value>
<base64>NzM1ODgyMjkyMDU=&#10;</base64>
</value>
</param>
</params>
"
object(stdClass)#1 (2) {
["xmlrpc_type"]=>
string(6) "base64"
["scalar"]=>
int(73588229205)
}

12
ext/xmlrpc/xmlrpc-epi-php.c
View file

@ -514,7 +514,15 @@ static XMLRPC_VALUE PHP_to_XMLRPC_worker (const char* key, zval* in_val, int dep
xReturn = XMLRPC_CreateValueEmpty(); xReturn = XMLRPC_CreateValueEmpty();
XMLRPC_SetValueID(xReturn, key, 0); XMLRPC_SetValueID(xReturn, key, 0);
} else { } else {
xReturn = XMLRPC_CreateValueBase64(key, Z_STRVAL(val), Z_STRLEN(val)); if (Z_TYPE(val) != IS_STRING) {
zval newvalue;
ZVAL_DUP(&newvalue, &val);
convert_to_string(newvalue);
xReturn = XMLRPC_CreateValueBase64(key, Z_STRVAL(newvalue), Z_STRLEN(newvalue));
zval_dtor(&newvalue);
} else {
xReturn = XMLRPC_CreateValueBase64(key, Z_STRVAL(val), Z_STRLEN(val));
}
} }
break; break;
case xmlrpc_datetime: case xmlrpc_datetime:
@ -1357,7 +1365,7 @@ XMLRPC_VALUE_TYPE get_zval_xmlrpc_type(zval* value, zval* newvalue) /* {{{ */
if (newvalue) { if (newvalue) {
zval* val; zval* val;
if ((type == xmlrpc_base64 && Z_TYPE_P(value) != IS_NULL) || type == xmlrpc_datetime) { if ((type == xmlrpc_base64 && Z_TYPE_P(value) == IS_OBJECT) || type == xmlrpc_datetime) {
if ((val = zend_hash_str_find(Z_OBJPROP_P(value), OBJECT_VALUE_ATTR, sizeof(OBJECT_VALUE_ATTR) - 1)) != NULL) { if ((val = zend_hash_str_find(Z_OBJPROP_P(value), OBJECT_VALUE_ATTR, sizeof(OBJECT_VALUE_ATTR) - 1)) != NULL) {
ZVAL_COPY_VALUE(newvalue, val); ZVAL_COPY_VALUE(newvalue, val);
} }