Null pointer dereference while serializing the response #9720

Activity

1. istoph

   added

   Bug

   Status: Needs Triage

   on Oct 11, 2022
2. istoph commented on Oct 11, 2022

   

   istoph

   on Oct 11, 2022

   Author

   More actions

   We have been able to fix this on our site with the following patch. We do not know if this patch is also suitable for upstream.

   --- php-src/ext/soap/soap.c	2022-10-10 11:35:34.000000000 +0200
   +++ soap.c	2022-10-10 18:22:04.000000000 +0200
   @@ -3791,15 +3791,15 @@
    	} else if (param_count > 1 && Z_TYPE_P(ret) == IS_ARRAY) {
    		zval *data;
    		int i = 0;
   -		zend_string *param_name;
   +		char *param_name;
    		zend_ulong param_index = i;
    
    		ZEND_HASH_FOREACH_KEY_VAL(Z_ARRVAL_P(ret), param_index, param_name, data) {
   -			parameter = get_param(function, ZSTR_VAL(param_name), param_index, TRUE);
   +			parameter = get_param(function, param_name, param_index, TRUE);
    			if (style == SOAP_RPC) {
   -				param = serialize_parameter(parameter, data, i, ZSTR_VAL(param_name), use, method);
   +				param = serialize_parameter(parameter, data, i, param_name, use, method);
    			} else {
   -				param = serialize_parameter(parameter, data, i, ZSTR_VAL(param_name), use, body);
   +				param = serialize_parameter(parameter, data, i, param_name, use, body);
    				if (function && function->binding->bindingType == BINDING_SOAP) {
    					if (parameter && parameter->element) {
    						ns = encode_add_ns(param, parameter->element->namens);
   
3. cmb69

   added

   Extension: soap

   on Oct 11, 2022
4. cmb69 commented on Oct 12, 2022

   

   cmb69

   on Oct 12, 2022

   Member

   More actions

   Thanks for reporting! I can confirm the issue, but your patch wouldn't even compile for me, since ZEND_HASH_FOREACH_KEY_VAL's param_name is supposed to be a zend_string* (not a char*). Did you perhaps also replace ZEND_HASH_FOREACH_KEY_VAL with some other macro which yields a char*? I'm not sure if there is even something like this, so I worked around:

    ext/soap/soap.c | 6 +++---
    1 file changed, 3 insertions(+), 3 deletions(-)
   
   diff --git a/ext/soap/soap.c b/ext/soap/soap.c
   index d5731a5c9b..fbf6546beb 100644
   --- a/ext/soap/soap.c
   +++ b/ext/soap/soap.c
   @@ -3360,11 +3360,11 @@ static int serialize_response_call2(xmlNodePtr body, sdlFunctionPtr function, ch
    		zend_ulong param_index = i;
    
    		ZEND_HASH_FOREACH_KEY_VAL(Z_ARRVAL_P(ret), param_index, param_name, data) {
   -			parameter = get_param(function, ZSTR_VAL(param_name), param_index, TRUE);
   +			parameter = get_param(function, param_name ? ZSTR_VAL(param_name) : NULL, param_index, TRUE);
    			if (style == SOAP_RPC) {
   -				param = serialize_parameter(parameter, data, i, ZSTR_VAL(param_name), use, method);
   +				param = serialize_parameter(parameter, data, i, param_name ? ZSTR_VAL(param_name) : NULL, use, method);
    			} else {
   -				param = serialize_parameter(parameter, data, i, ZSTR_VAL(param_name), use, body);
   +				param = serialize_parameter(parameter, data, i, param_name ? ZSTR_VAL(param_name) : NULL, use, body);
    				if (function && function->binding->bindingType == BINDING_SOAP) {
    					if (parameter && parameter->element) {
    						ns = encode_add_ns(param, parameter->element->namens);
5. cmb69

   self-assigned this

   on Oct 12, 2022
6. cmb69

   added

   Status: Verified

   and removed

   Status: Needs Triage

   on Oct 12, 2022
7. istoph commented on Oct 13, 2022

   

   istoph

   on Oct 13, 2022

   Author

   More actions

   @cmb69 Thank you for looking at the bug! I have applied the change you customized to our test environment and all unit and integration tests are running. So this patch would be a great help for us.

   👍React with 👍1Reacted by Christoph M. Becker
8. cmb69

   added a commit that references this issue on Oct 13, 2022

   Fix phpGH-9720: Null pointer dereference while serializing the response

   ...

   This issue will close once commit 475f817 is merged into the 'master' branch.

   475f817
9. cmb69

   linked a pull request that will close this issueFix GH-9720: Null pointer dereference while serializing the response #9739on Oct 13, 2022
10. cmb69

    changed the title [-]segfault in php-soap, type conflict with zend_string and char[/-] [+]Null pointer dereference while serializing the response[/+] on Oct 13, 2022
11. cmb69

    added a commit that references this issue on Oct 13, 2022

    Fix GH-9720: Null pointer dereference while serializing the response

    ...

    This issue will close once commit e440e37 is merged into the 'master' branch.

    e440e37
12. cmb69

    closed this as completedin e440e37on Oct 13, 2022
13. cmb69

    added 3 commits that reference this issue on Oct 13, 2022

    Merge branch 'PHP-8.0' into PHP-8.1

    ...

    This issue will close once commit 24c2970 is merged into the 'master' branch.

    24c2970

    Merge branch 'PHP-8.1' into PHP-8.2

    ...

    This issue will close once commit aba82c7 is merged into the 'master' branch.

    aba82c7

    Merge branch 'PHP-8.2'

    ...

    This issue will close once commit d758f58 is merged into the 'master' branch.

    d758f58