0d15d688d2
- Fix XSS within status endpoint CVE-2026-6735 - Fix Stale SOAP_GLOBAL(ref_map) pointer with Apache Map CVE-2026-6722 - Fix Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION CVE-2026-7261 - Fix Broken Apache map value NULL check CVE-2026-7262 - Fix Signed integer overflow of char array offset CVE-2026-7568 - Fix Consistently pass unsigned char to ctype.h functions CVE-2026-7258 Resolves: RHEL-181020
114 lines
3.7 KiB
Diff
114 lines
3.7 KiB
Diff
From dd14d36e31dd99b7589f917924840fe4f46ca022 Mon Sep 17 00:00:00 2001
|
|
From: Ilija Tovilo <ilija.tovilo@me.com>
|
|
Date: Sun, 3 May 2026 19:57:16 +0200
|
|
Subject: [PATCH 2/9] GHSA-m33r-qmcv-p97q: [soap] Fix use-after-free after
|
|
header parsing failure with SOAP_PERSISTENCE_SESSION
|
|
|
|
Fixes GHSA-m33r-qmcv-p97q
|
|
Fixes CVE-2026-7261
|
|
|
|
(cherry picked from commit db2a7f9348fd5dda5fd162061786a664c417bf5b)
|
|
(cherry picked from commit 5dd8dd8493d49bb6fcd810a6e9d2ffb6fdc15714)
|
|
(cherry picked from commit 63cf032e9675d7d2bbc007c8c787597187a7567b)
|
|
---
|
|
ext/soap/soap.c | 12 ++++-
|
|
ext/soap/tests/GHSA-m33r-qmcv-p97q.phpt | 58 +++++++++++++++++++++++++
|
|
2 files changed, 68 insertions(+), 2 deletions(-)
|
|
create mode 100644 ext/soap/tests/GHSA-m33r-qmcv-p97q.phpt
|
|
|
|
diff --git a/ext/soap/soap.c b/ext/soap/soap.c
|
|
index 94f1db526c6..ccc21d13af1 100644
|
|
--- a/ext/soap/soap.c
|
|
+++ b/ext/soap/soap.c
|
|
@@ -1807,13 +1807,21 @@ PHP_METHOD(SoapServer, handle)
|
|
php_output_discard();
|
|
soap_server_fault_ex(function, &h->retval, h);
|
|
efree(fn_name);
|
|
- if (service->type == SOAP_CLASS && soap_obj) {zval_ptr_dtor(soap_obj);}
|
|
+ if (service->type == SOAP_CLASS && soap_obj) {
|
|
+ if (service->soap_class.persistence != SOAP_PERSISTENCE_SESSION) {
|
|
+ zval_ptr_dtor(soap_obj);
|
|
+ }
|
|
+ }
|
|
goto fail;
|
|
} else if (EG(exception)) {
|
|
php_output_discard();
|
|
_soap_server_exception(service, function, ZEND_THIS);
|
|
efree(fn_name);
|
|
- if (service->type == SOAP_CLASS && soap_obj) {zval_ptr_dtor(soap_obj);}
|
|
+ if (service->type == SOAP_CLASS && soap_obj) {
|
|
+ if (service->soap_class.persistence != SOAP_PERSISTENCE_SESSION) {
|
|
+ zval_ptr_dtor(soap_obj);
|
|
+ }
|
|
+ }
|
|
goto fail;
|
|
}
|
|
} else if (h->mustUnderstand) {
|
|
diff --git a/ext/soap/tests/GHSA-m33r-qmcv-p97q.phpt b/ext/soap/tests/GHSA-m33r-qmcv-p97q.phpt
|
|
new file mode 100644
|
|
index 00000000000..bcf441ccd18
|
|
--- /dev/null
|
|
+++ b/ext/soap/tests/GHSA-m33r-qmcv-p97q.phpt
|
|
@@ -0,0 +1,58 @@
|
|
+--TEST--
|
|
+GHSA-m33r-qmcv-p97q: Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION
|
|
+--CREDITS--
|
|
+Ilia Alshanetsky (iliaal)
|
|
+--EXTENSIONS--
|
|
+soap
|
|
+session
|
|
+--FILE--
|
|
+<?php
|
|
+
|
|
+class Handler {
|
|
+ public function return() {
|
|
+ return new SoapFault('Server', 'denied');
|
|
+ }
|
|
+ public function throw() {
|
|
+ throw new SoapFault('Server', 'denied');
|
|
+ }
|
|
+ public function hello() {
|
|
+ return 'ok';
|
|
+ }
|
|
+}
|
|
+
|
|
+session_start();
|
|
+
|
|
+$srv = new SoapServer(null, ['uri' => 'urn:a']);
|
|
+$srv->setClass(Handler::class);
|
|
+$srv->setPersistence(SOAP_PERSISTENCE_SESSION);
|
|
+
|
|
+$srv->handle(<<<XML
|
|
+<?xml version="1.0" encoding="UTF-8"?>
|
|
+<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:a="urn:a">
|
|
+ <soap:Header>
|
|
+ <a:return/>
|
|
+ </soap:Header>
|
|
+ <soap:Body>
|
|
+ <a:hello/>
|
|
+ </soap:Body>
|
|
+</soap:Envelope>
|
|
+XML);
|
|
+
|
|
+$srv->handle(<<<XML
|
|
+<?xml version="1.0" encoding="UTF-8"?>
|
|
+<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:a="urn:a">
|
|
+ <soap:Header>
|
|
+ <a:throw/>
|
|
+ </soap:Header>
|
|
+ <soap:Body>
|
|
+ <a:hello/>
|
|
+ </soap:Body>
|
|
+</soap:Envelope>
|
|
+XML);
|
|
+
|
|
+?>
|
|
+--EXPECT--
|
|
+<?xml version="1.0" encoding="UTF-8"?>
|
|
+<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"><SOAP-ENV:Body><SOAP-ENV:Fault><faultcode>SOAP-ENV:Server</faultcode><faultstring>denied</faultstring></SOAP-ENV:Fault></SOAP-ENV:Body></SOAP-ENV:Envelope>
|
|
+<?xml version="1.0" encoding="UTF-8"?>
|
|
+<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"><SOAP-ENV:Body><SOAP-ENV:Fault><faultcode>SOAP-ENV:Server</faultcode><faultstring>denied</faultstring></SOAP-ENV:Fault></SOAP-ENV:Body></SOAP-ENV:Envelope>
|
|
--
|
|
2.54.0
|
|
|