projects/aports·blob master · refs

107 lines · 3.3 KiB

1From 3441ffc60ccd7c6358067bd1fab1f0f54d34f290 Mon Sep 17 00:00:00 2001
2From: Ilija Tovilo <[email protected]>
3Date: Sun, 3 May 2026 19:56:53 +0200
4Subject: [PATCH 7/7] GHSA-85c2-q967-79q5: [soap] Fix stale
5 SOAP_GLOBAL(ref_map) pointer with Apache Map
6
7Fixes GHSA-85c2-q967-79q5
8Fixes CVE-2026-6722
9
10(cherry picked from commit 84e3004d25c2ce90f198eb39507489ba73c580aa)
11---
12 ext/soap/php_encoding.c | 3 +-
13 ext/soap/tests/GHSA-85c2-q967-79q5.phpt | 61 +++++++++++++++++++++++++
14 2 files changed, 63 insertions(+), 1 deletion(-)
15 create mode 100644 ext/soap/tests/GHSA-85c2-q967-79q5.phpt
16
17diff --git a/ext/soap/php_encoding.c b/ext/soap/php_encoding.c
18index 2ab8adb2a8f..9bd6f50834e 100644
19--- a/ext/soap/php_encoding.c
20+++ b/ext/soap/php_encoding.c
21@@ -365,6 +365,7 @@ static bool soap_check_xml_ref(zval *data, xmlNodePtr node)
22 static void soap_add_xml_ref(zval *data, xmlNodePtr node)
23 {
24 if (SOAP_GLOBAL(ref_map)) {
25+ Z_TRY_ADDREF_P(data);
26 zend_hash_index_update(SOAP_GLOBAL(ref_map), (zend_ulong)node, data);
27 }
28 }
29@@ -3437,7 +3438,7 @@ void encode_reset_ns()
30 } else {
31 SOAP_GLOBAL(ref_map) = emalloc(sizeof(HashTable));
32 }
33- zend_hash_init(SOAP_GLOBAL(ref_map), 0, NULL, NULL, 0);
34+ zend_hash_init(SOAP_GLOBAL(ref_map), 0, NULL, ZVAL_PTR_DTOR, 0);
35 }
36
37 void encode_finish()
38diff --git a/ext/soap/tests/GHSA-85c2-q967-79q5.phpt b/ext/soap/tests/GHSA-85c2-q967-79q5.phpt
39new file mode 100644
40index 00000000000..8bcac26ad18
41--- /dev/null
42+++ b/ext/soap/tests/GHSA-85c2-q967-79q5.phpt
43@@ -0,0 +1,61 @@
44+--TEST--
45+GHSA-85c2-q967-79q5: Stale SOAP_GLOBAL(ref_map) pointer with Apache Map
46+--CREDITS--
47+brettgervasoni
48+--EXTENSIONS--
49+soap
50+--FILE--
51+<?php
52+
53+class Handler {
54+ public function test(...$args) {
55+ $GLOBALS['result'] = $args;
56+ }
57+}
58+
59+$envelope = <<<'XML'
60+<?xml version="1.0" encoding="UTF-8"?>
61+<soapenv:Envelope
62+ xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
63+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
64+ xmlns:xsd="http://www.w3.org/2001/XMLSchema">
65+
66+ <soapenv:Body>
67+ <test>
68+ <map xsi:type="apache:Map" xmlns:apache="http://xml.apache.org/xml-soap">
69+ <item>
70+ <key>foo</key>
71+ <value id="stale"><object>bar</object></value>
72+ </item>
73+ <item>
74+ <key>foo</key>
75+ <value>baz</value>
76+ </item>
77+ </map>
78+ <stale href="#stale"/>
79+ </test>
80+ </soapenv:Body>
81+</soapenv:Envelope>
82+XML;
83+
84+$s = new SoapServer(null, ['uri' => 'urn:a']);
85+$s->setClass(Handler::class);
86+$s->handle($envelope);
87+var_dump($result);
88+
89+?>
90+--EXPECTF--
91+<?xml version="1.0" encoding="UTF-8"?>
92+<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="urn:a" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><ns1:testResponse><return xsi:nil="true"/></ns1:testResponse></SOAP-ENV:Body></SOAP-ENV:Envelope>
93+array(2) {
94+ [0]=>
95+ array(1) {
96+ ["foo"]=>
97+ string(3) "baz"
98+ }
99+ [1]=>
100+ object(stdClass)#%d (1) {
101+ ["object"]=>
102+ string(3) "bar"
103+ }
104+}
105--
1062.53.0
107