[2010-03-13 03:20 UTC] geissert@php.net

Description:
------------
This is CVE-2010-0397, originally reported by Auke van Slooten at http://bugs.debian.org/573573

When processing an invalid (one without a <methodName>, required by the specs) XML-RPC request, the extension doesn't check for the NULL value returned by the xmlrpc library. This NULL is then passed to estrdup which dereferences the pointer, leading to a segmentation fault. This can easily be used to perform DoS attacks by crashing the server.

I've already notified security@php.net, but since the issue is public there's no point in hiding it or the patch. The attached patch fixes the problem, which can also be found at:

http://git.debian.org/?p=pkg-php/php.git;a=blob;f=debian/patches/CVE-2010-0397.patch;h=186b2166644c066f28f1ffb9195ffa9f5744a604;hb=HEAD


Test script:
---------------
<?php
$method = '';
$req = '<?xml version="1.0"?><methodCall></methodCall>';
var_dump(xmlrpc_decode_request($req, $method));
var_dump($method);
echo "Done\n";
?>

Expected result:
----------------
NULL
NULL
Done

Actual result:
--------------
Segmentation fault