!47 fix CVE-2021-21702
From: @angela7 Reviewed-by: @overweight Signed-off-by: @overweight
This commit is contained in:
openeuler-ci-bot
Gitee
commit
6e56111b40
193
CVE-2021-21702.patch
Normal file
193
CVE-2021-21702.patch
Normal file
@ -0,0 +1,193 @@
|
||||
From 3c939e3f69955d087e0bb671868f7267dfb2a502 Mon Sep 17 00:00:00 2001
|
||||
From: Stanislav Malyshev <stas@php.net>
|
||||
Date: Sun, 31 Jan 2021 21:15:23 -0800
|
||||
Subject: [PATCH] Fix bug #80672 - Null Dereference in SoapClient
|
||||
|
||||
---
|
||||
ext/soap/php_sdl.c | 26 ++++++++++++++------------
|
||||
ext/soap/php_xml.c | 4 ++--
|
||||
ext/soap/tests/bug80672.phpt | 15 +++++++++++++++
|
||||
ext/soap/tests/bug80672.xml | 6 ++++++
|
||||
5 files changed, 37 insertions(+), 14 deletions(-)
|
||||
create mode 100644 ext/soap/tests/bug80672.phpt
|
||||
create mode 100644 ext/soap/tests/bug80672.xml
|
||||
|
||||
diff --git a/ext/soap/php_sdl.c b/ext/soap/php_sdl.c
|
||||
index 1875bec41d..67ab4097c2 100644
|
||||
--- a/ext/soap/php_sdl.c
|
||||
+++ b/ext/soap/php_sdl.c
|
||||
@@ -313,6 +313,8 @@ void sdl_restore_uri_credentials(sdlCtx *ctx)
|
||||
ctx->context = NULL;
|
||||
}
|
||||
|
||||
+#define SAFE_STR(a) ((a)?a:"")
|
||||
+
|
||||
static void load_wsdl_ex(zval *this_ptr, char *struri, sdlCtx *ctx, int include)
|
||||
{
|
||||
sdlPtr tmpsdl = ctx->sdl;
|
||||
@@ -374,7 +376,7 @@ static void load_wsdl_ex(zval *this_ptr, char *struri, sdlCtx *ctx, int include)
|
||||
if (node_is_equal_ex(trav2, "schema", XSD_NAMESPACE)) {
|
||||
load_schema(ctx, trav2);
|
||||
} else if (is_wsdl_element(trav2) && !node_is_equal(trav2,"documentation")) {
|
||||
- soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav2->name);
|
||||
+ soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav2->name));
|
||||
}
|
||||
trav2 = trav2->next;
|
||||
}
|
||||
@@ -435,7 +437,7 @@ static void load_wsdl_ex(zval *this_ptr, char *struri, sdlCtx *ctx, int include)
|
||||
soap_error0(E_ERROR, "Parsing WSDL: <service> has no name attribute");
|
||||
}
|
||||
} else if (!node_is_equal(trav,"documentation")) {
|
||||
- soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav->name);
|
||||
+ soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav->name));
|
||||
}
|
||||
trav = trav->next;
|
||||
}
|
||||
@@ -545,7 +547,7 @@ static sdlSoapBindingFunctionHeaderPtr wsdl_soap_binding_header(sdlCtx* ctx, xml
|
||||
}
|
||||
smart_str_free(&key);
|
||||
} else if (is_wsdl_element(trav) && !node_is_equal(trav,"documentation")) {
|
||||
- soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav->name);
|
||||
+ soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav->name));
|
||||
}
|
||||
trav = trav->next;
|
||||
}
|
||||
@@ -647,7 +649,7 @@ static void wsdl_soap_binding_body(sdlCtx* ctx, xmlNodePtr node, char* wsdl_soap
|
||||
}
|
||||
smart_str_free(&key);
|
||||
} else if (is_wsdl_element(trav) && !node_is_equal(trav,"documentation")) {
|
||||
- soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav->name);
|
||||
+ soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav->name));
|
||||
}
|
||||
trav = trav->next;
|
||||
}
|
||||
@@ -679,14 +681,14 @@ static HashTable* wsdl_message(sdlCtx *ctx, xmlChar* message_name)
|
||||
sdlParamPtr param;
|
||||
|
||||
if (trav->ns != NULL && strcmp((char*)trav->ns->href, WSDL_NAMESPACE) != 0) {
|
||||
- soap_error1(E_ERROR, "Parsing WSDL: Unexpected extensibility element <%s>", trav->name);
|
||||
+ soap_error1(E_ERROR, "Parsing WSDL: Unexpected extensibility element <%s>", SAFE_STR(trav->name));
|
||||
}
|
||||
if (node_is_equal(trav,"documentation")) {
|
||||
trav = trav->next;
|
||||
continue;
|
||||
}
|
||||
if (!node_is_equal(trav,"part")) {
|
||||
- soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav->name);
|
||||
+ soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav->name));
|
||||
}
|
||||
part = trav;
|
||||
param = emalloc(sizeof(sdlParam));
|
||||
@@ -695,7 +697,7 @@ static HashTable* wsdl_message(sdlCtx *ctx, xmlChar* message_name)
|
||||
|
||||
name = get_attribute(part->properties, "name");
|
||||
if (name == NULL) {
|
||||
- soap_error1(E_ERROR, "Parsing WSDL: No name associated with <part> '%s'", message->name);
|
||||
+ soap_error1(E_ERROR, "Parsing WSDL: No name associated with <part> '%s'", SAFE_STR(message->name));
|
||||
}
|
||||
|
||||
param->paramName = estrdup((char*)name->children->content);
|
||||
@@ -764,7 +766,7 @@ static sdlPtr load_wsdl(zval *this_ptr, char *struri)
|
||||
continue;
|
||||
}
|
||||
if (!node_is_equal(trav,"port")) {
|
||||
- soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav->name);
|
||||
+ soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav->name));
|
||||
}
|
||||
|
||||
port = trav;
|
||||
@@ -803,7 +805,7 @@ static sdlPtr load_wsdl(zval *this_ptr, char *struri)
|
||||
}
|
||||
}
|
||||
if (trav2 != address && is_wsdl_element(trav2) && !node_is_equal(trav2,"documentation")) {
|
||||
- soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav2->name);
|
||||
+ soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav2->name));
|
||||
}
|
||||
trav2 = trav2->next;
|
||||
}
|
||||
@@ -905,7 +907,7 @@ static sdlPtr load_wsdl(zval *this_ptr, char *struri)
|
||||
continue;
|
||||
}
|
||||
if (!node_is_equal(trav2,"operation")) {
|
||||
- soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav2->name);
|
||||
+ soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav2->name));
|
||||
}
|
||||
|
||||
operation = trav2;
|
||||
@@ -924,7 +926,7 @@ static sdlPtr load_wsdl(zval *this_ptr, char *struri)
|
||||
!node_is_equal(trav3,"output") &&
|
||||
!node_is_equal(trav3,"fault") &&
|
||||
!node_is_equal(trav3,"documentation")) {
|
||||
- soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav3->name);
|
||||
+ soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav3->name));
|
||||
}
|
||||
trav3 = trav3->next;
|
||||
}
|
||||
@@ -1102,7 +1104,7 @@ static sdlPtr load_wsdl(zval *this_ptr, char *struri)
|
||||
}
|
||||
}
|
||||
} else if (is_wsdl_element(trav) && !node_is_equal(trav,"documentation")) {
|
||||
- soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav->name);
|
||||
+ soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav->name));
|
||||
}
|
||||
trav = trav->next;
|
||||
}
|
||||
diff --git a/ext/soap/php_xml.c b/ext/soap/php_xml.c
|
||||
index 8d07bb0d83..a1ab525de3 100644
|
||||
--- a/ext/soap/php_xml.c
|
||||
+++ b/ext/soap/php_xml.c
|
||||
@@ -203,7 +203,7 @@ xmlNsPtr node_find_ns(xmlNodePtr node)
|
||||
|
||||
int attr_is_equal_ex(xmlAttrPtr node, char *name, char *ns)
|
||||
{
|
||||
- if (name == NULL || strcmp((char*)node->name, name) == 0) {
|
||||
+ if (name == NULL || ((node->name) && strcmp((char*)node->name, name) == 0)) {
|
||||
if (ns) {
|
||||
xmlNsPtr nsPtr = attr_find_ns(node);
|
||||
if (nsPtr) {
|
||||
@@ -219,7 +219,7 @@ int attr_is_equal_ex(xmlAttrPtr node, char *name, char *ns)
|
||||
|
||||
int node_is_equal_ex(xmlNodePtr node, char *name, char *ns)
|
||||
{
|
||||
- if (name == NULL || strcmp((char*)node->name, name) == 0) {
|
||||
+ if (name == NULL || ((node->name) && strcmp((char*)node->name, name) == 0)) {
|
||||
if (ns) {
|
||||
xmlNsPtr nsPtr = node_find_ns(node);
|
||||
if (nsPtr) {
|
||||
diff --git a/ext/soap/tests/bug80672.phpt b/ext/soap/tests/bug80672.phpt
|
||||
new file mode 100644
|
||||
index 0000000000..71e2b1d841
|
||||
--- /dev/null
|
||||
+++ b/ext/soap/tests/bug80672.phpt
|
||||
@@ -0,0 +1,15 @@
|
||||
+--TEST--
|
||||
+Bug #80672 Null Dereference in SoapClient
|
||||
+--SKIPIF--
|
||||
+<?php require_once('skipif.inc'); ?>
|
||||
+--FILE--
|
||||
+<?php
|
||||
+try {
|
||||
+ $client = new SoapClient(__DIR__ . "/bug80672.xml");
|
||||
+ $query = $soap->query(array('sXML' => 'something'));
|
||||
+} catch(SoapFault $e) {
|
||||
+ print $e->getMessage();
|
||||
+}
|
||||
+?>
|
||||
+--EXPECTF--
|
||||
+SOAP-ERROR: Parsing WSDL: Unexpected WSDL element <>
|
||||
\ No newline at end of file
|
||||
diff --git a/ext/soap/tests/bug80672.xml b/ext/soap/tests/bug80672.xml
|
||||
new file mode 100644
|
||||
index 0000000000..0fa185bf1e
|
||||
--- /dev/null
|
||||
+++ b/ext/soap/tests/bug80672.xml
|
||||
@@ -0,0 +1,6 @@
|
||||
+<?xml version="1.0" encoding="ISO-8859-1"?>
|
||||
+<soap:definitions xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
+ xmlns:xsd="http://www.w3.org/2001/XMLSchema"
|
||||
+ xmlns:soap="http://schemas.xmlsoap.org/wsdl/">
|
||||
+<![CDATA[test]]>
|
||||
+</soap:definitions>
|
||||
--
|
||||
2.11.0
|
||||
|
||||
6
php.spec
6
php.spec
@ -27,7 +27,7 @@
|
||||
|
||||
Name: php
|
||||
Version: %{upver}%{?rcver:~%{rcver}}
|
||||
Release: 2
|
||||
Release: 3
|
||||
Summary: PHP scripting language for creating dynamic web sites
|
||||
License: PHP and Zend-2.0 and BSD and MIT and ASL 1.0 and NCSA
|
||||
URL: http://www.php.net/
|
||||
@ -58,6 +58,7 @@ Patch6: php-7.4.0-ldap_r.patch
|
||||
Patch7: php-8.0.0-phpinfo.patch
|
||||
Patch8: php-7.4.0-datetests.patch
|
||||
Patch9: backport-CVE-2020-7071-Fix-bug-77423.patch
|
||||
Patch10: CVE-2021-21702.patch
|
||||
|
||||
BuildRequires: bzip2-devel, curl-devel >= 7.9, httpd-devel >= 2.0.46-1, pam-devel, httpd-filesystem, nginx-filesystem
|
||||
BuildRequires: libstdc++-devel, openssl-devel, sqlite-devel >= 3.6.0, zlib-devel, smtpdaemon, libedit-devel
|
||||
@ -1096,6 +1097,9 @@ systemctl try-restart php-fpm.service >/dev/null 2>&1 || :
|
||||
|
||||
|
||||
%changelog
|
||||
* Tue Jun 1 2021 guoxiaoqi <guoxiaoqi2@huawei.com> - 8.0.0-3
|
||||
- Fix CVE-2021-21702
|
||||
|
||||
* Fri Jan 29 2021 panxiaohe <panxiaohe@huawei.com> - 8.0.0-2
|
||||
- Fix CVE-2020-7071
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user