|
 |
f51295 |
From 4feb9e66ff9636ad44bc23a91b7ebd37d83ddf1d Mon Sep 17 00:00:00 2001
|
|
|
f51295 |
From: Stanislav Malyshev <stas@php.net>
|
|
|
f51295 |
Date: Tue, 1 Jan 2019 17:15:20 -0800
|
|
|
f51295 |
Subject: [PATCH] Fix bug #77380 (Global out of bounds read in xmlrpc base64
|
|
|
f51295 |
code)
|
|
|
f51295 |
|
|
|
f51295 |
---
|
|
|
f51295 |
ext/xmlrpc/libxmlrpc/base64.c | 4 ++--
|
|
|
f51295 |
ext/xmlrpc/tests/bug77380.phpt | 17 +++++++++++++++++
|
|
|
f51295 |
2 files changed, 19 insertions(+), 2 deletions(-)
|
|
|
f51295 |
create mode 100644 ext/xmlrpc/tests/bug77380.phpt
|
|
|
f51295 |
|
|
|
f51295 |
diff --git a/ext/xmlrpc/libxmlrpc/base64.c b/ext/xmlrpc/libxmlrpc/base64.c
|
|
|
f51295 |
index 5ebdf31..a4fa193 100644
|
|
|
f51295 |
--- a/ext/xmlrpc/libxmlrpc/base64.c
|
|
|
f51295 |
+++ b/ext/xmlrpc/libxmlrpc/base64.c
|
|
|
f51295 |
@@ -165,7 +165,7 @@ void base64_decode_xmlrpc(struct buffer_st *bfr, const char *source, int length)
|
|
|
f51295 |
return;
|
|
|
f51295 |
}
|
|
|
f51295 |
|
|
|
f51295 |
- if (dtable[c] & 0x80) {
|
|
|
f51295 |
+ if (dtable[(unsigned char)c] & 0x80) {
|
|
|
f51295 |
/*
|
|
|
f51295 |
fprintf(stderr, "Offset %i length %i\n", offset, length);
|
|
|
f51295 |
fprintf(stderr, "character '%c:%x:%c' in input file.\n", c, c, dtable[c]);
|
|
|
f51295 |
diff --git a/ext/xmlrpc/tests/bug77380.phpt b/ext/xmlrpc/tests/bug77380.phpt
|
|
|
f51295 |
new file mode 100644
|
|
|
f51295 |
index 0000000..8559c07
|
|
|
f51295 |
--- /dev/null
|
|
|
f51295 |
+++ b/ext/xmlrpc/tests/bug77380.phpt
|
|
|
f51295 |
@@ -0,0 +1,17 @@
|
|
|
f51295 |
+--TEST--
|
|
|
f51295 |
+Bug #77380 (Global out of bounds read in xmlrpc base64 code)
|
|
|
f51295 |
+--SKIPIF--
|
|
|
f51295 |
+
|
|
|
f51295 |
+if (!extension_loaded("xmlrpc")) print "skip";
|
|
|
f51295 |
+?>
|
|
|
f51295 |
+--FILE--
|
|
|
f51295 |
+
|
|
|
f51295 |
+var_dump(xmlrpc_decode(base64_decode("PGJhc2U2ND7CkzwvYmFzZTY0Pgo=")));
|
|
|
f51295 |
+?>
|
|
|
f51295 |
+--EXPECT--
|
|
|
f51295 |
+object(stdClass)#1 (2) {
|
|
|
f51295 |
+ ["scalar"]=>
|
|
|
f51295 |
+ string(0) ""
|
|
|
f51295 |
+ ["xmlrpc_type"]=>
|
|
|
f51295 |
+ string(6) "base64"
|
|
|
f51295 |
+}
|
|
|
f51295 |
--
|
|
|
f51295 |
2.1.4
|
|
|
f51295 |
|