projects/aports·blob master · refs

111 lines · 3.6 KiB

1From e3ee67eff3660fc802f9a7f65af0f5c7de7a651d Mon Sep 17 00:00:00 2001
2From: Ilija Tovilo <[email protected]>
3Date: Sun, 3 May 2026 19:57:16 +0200
4Subject: [PATCH 6/7] GHSA-m33r-qmcv-p97q: [soap] Fix use-after-free after
5 header parsing failure with SOAP_PERSISTENCE_SESSION
6
7Fixes GHSA-m33r-qmcv-p97q
8Fixes CVE-2026-7261
9
10(cherry picked from commit b9f81deadfda4df332fd75e20c03b3812038cd3f)
11---
12 ext/soap/soap.c | 12 ++++-
13 ext/soap/tests/GHSA-m33r-qmcv-p97q.phpt | 58 +++++++++++++++++++++++++
14 2 files changed, 68 insertions(+), 2 deletions(-)
15 create mode 100644 ext/soap/tests/GHSA-m33r-qmcv-p97q.phpt
16
17diff --git a/ext/soap/soap.c b/ext/soap/soap.c
18index 3bc713ca76b..bb8b664af58 100644
19--- a/ext/soap/soap.c
20+++ b/ext/soap/soap.c
21@@ -1477,13 +1477,21 @@ PHP_METHOD(SoapServer, handle)
22 php_output_discard();
23 soap_server_fault_ex(function, &h->retval, h);
24 zend_string_release(fn_name);
25- if (service->type == SOAP_CLASS && soap_obj) {zval_ptr_dtor(soap_obj);}
26+ if (service->type == SOAP_CLASS && soap_obj) {
27+ if (service->soap_class.persistence != SOAP_PERSISTENCE_SESSION) {
28+ zval_ptr_dtor(soap_obj);
29+ }
30+ }
31 goto fail;
32 } else if (EG(exception)) {
33 php_output_discard();
34 _soap_server_exception(service, function, ZEND_THIS);
35 zend_string_release(fn_name);
36- if (service->type == SOAP_CLASS && soap_obj) {zval_ptr_dtor(soap_obj);}
37+ if (service->type == SOAP_CLASS && soap_obj) {
38+ if (service->soap_class.persistence != SOAP_PERSISTENCE_SESSION) {
39+ zval_ptr_dtor(soap_obj);
40+ }
41+ }
42 goto fail;
43 }
44 } else if (h->mustUnderstand) {
45diff --git a/ext/soap/tests/GHSA-m33r-qmcv-p97q.phpt b/ext/soap/tests/GHSA-m33r-qmcv-p97q.phpt
46new file mode 100644
47index 00000000000..bcf441ccd18
48--- /dev/null
49+++ b/ext/soap/tests/GHSA-m33r-qmcv-p97q.phpt
50@@ -0,0 +1,58 @@
51+--TEST--
52+GHSA-m33r-qmcv-p97q: Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION
53+--CREDITS--
54+Ilia Alshanetsky (iliaal)
55+--EXTENSIONS--
56+soap
57+session
58+--FILE--
59+<?php
60+
61+class Handler {
62+ public function return() {
63+ return new SoapFault('Server', 'denied');
64+ }
65+ public function throw() {
66+ throw new SoapFault('Server', 'denied');
67+ }
68+ public function hello() {
69+ return 'ok';
70+ }
71+}
72+
73+session_start();
74+
75+$srv = new SoapServer(null, ['uri' => 'urn:a']);
76+$srv->setClass(Handler::class);
77+$srv->setPersistence(SOAP_PERSISTENCE_SESSION);
78+
79+$srv->handle(<<<XML
80+<?xml version="1.0" encoding="UTF-8"?>
81+<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:a="urn:a">
82+ <soap:Header>
83+ <a:return/>
84+ </soap:Header>
85+ <soap:Body>
86+ <a:hello/>
87+ </soap:Body>
88+</soap:Envelope>
89+XML);
90+
91+$srv->handle(<<<XML
92+<?xml version="1.0" encoding="UTF-8"?>
93+<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:a="urn:a">
94+ <soap:Header>
95+ <a:throw/>
96+ </soap:Header>
97+ <soap:Body>
98+ <a:hello/>
99+ </soap:Body>
100+</soap:Envelope>
101+XML);
102+
103+?>
104+--EXPECT--
105+<?xml version="1.0" encoding="UTF-8"?>
106+<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"><SOAP-ENV:Body><SOAP-ENV:Fault><faultcode>SOAP-ENV:Server</faultcode><faultstring>denied</faultstring></SOAP-ENV:Fault></SOAP-ENV:Body></SOAP-ENV:Envelope>
107+<?xml version="1.0" encoding="UTF-8"?>
108+<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"><SOAP-ENV:Body><SOAP-ENV:Fault><faultcode>SOAP-ENV:Server</faultcode><faultstring>denied</faultstring></SOAP-ENV:Fault></SOAP-ENV:Body></SOAP-ENV:Envelope>
109--
1102.53.0
111