diff options
| author | Raphael Geissert <geissert@php.net> | 2010-03-13 18:40:29 +0000 |
|---|---|---|
| committer | Raphael Geissert <geissert@php.net> | 2010-03-13 18:40:29 +0000 |
| commit | 907dae8b21fcbc3979b3a9f206f10f506e452537 (patch) | |
| tree | ddb77a9490558c1be8a841aac6a2fe5fe6c1ffc9 /ext/xmlrpc/xmlrpc-epi-php.c | |
| parent | 5ff69f3d9ab9f1d5b7333da354e2b1fa2b53d27d (diff) | |
| download | php-git-907dae8b21fcbc3979b3a9f206f10f506e452537.tar.gz | |
Fix CVE-2010-0397: null pointer dereference when processing invalid XML-RPC
requests (bug #51288)
Diffstat (limited to 'ext/xmlrpc/xmlrpc-epi-php.c')
| -rw-r--r-- | ext/xmlrpc/xmlrpc-epi-php.c | 14 |
1 files changed, 10 insertions, 4 deletions
diff --git a/ext/xmlrpc/xmlrpc-epi-php.c b/ext/xmlrpc/xmlrpc-epi-php.c index e41d8c2353..256076070d 100644 --- a/ext/xmlrpc/xmlrpc-epi-php.c +++ b/ext/xmlrpc/xmlrpc-epi-php.c @@ -784,6 +784,7 @@ zval* decode_request_worker(char *xml_in, int xml_in_len, char *encoding_in, zva zval* retval = NULL; XMLRPC_REQUEST response; STRUCT_XMLRPC_REQUEST_INPUT_OPTIONS opts = {{0}}; + const char *method_name; opts.xml_elem_opts.encoding = encoding_in ? utf8_get_encoding_id_from_string(encoding_in) : ENCODING_DEFAULT; /* generate XMLRPC_REQUEST from raw xml */ @@ -794,10 +795,15 @@ zval* decode_request_worker(char *xml_in, int xml_in_len, char *encoding_in, zva if (XMLRPC_RequestGetRequestType(response) == xmlrpc_request_call) { if (method_name_out) { - zval_dtor(method_name_out); - Z_TYPE_P(method_name_out) = IS_STRING; - Z_STRVAL_P(method_name_out) = estrdup(XMLRPC_RequestGetMethodName(response)); - Z_STRLEN_P(method_name_out) = strlen(Z_STRVAL_P(method_name_out)); + method_name = XMLRPC_RequestGetMethodName(response); + if (method_name) { + zval_dtor(method_name_out); + Z_TYPE_P(method_name_out) = IS_STRING; + Z_STRVAL_P(method_name_out) = estrdup(method_name); + Z_STRLEN_P(method_name_out) = strlen(Z_STRVAL_P(method_name_out)); + } else { + retval = NULL; + } } } |