summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorRemi Collet <remi@remirepo.net>2021-11-15 09:27:54 +0100
committerRemi Collet <remi@php.net>2021-11-15 09:27:54 +0100
commit5575ebbeb35c019c8fd514feb0f01691f9e3f4a1 (patch)
tree806d75ddd9dccbde33073c49d8b8f5ba0ac8e7bf
parent153e8f632a497549bc05324c6078964b433c63b5 (diff)
Fix #79971 special character is breaking the path in xml function
CVE-2021-21707
-rw-r--r--failed.txt4
-rw-r--r--php-bug79971.patch167
-rw-r--r--php72.spec8
3 files changed, 176 insertions, 3 deletions
diff --git a/failed.txt b/failed.txt
index bc545ee..366e39c 100644
--- a/failed.txt
+++ b/failed.txt
@@ -1,6 +1,6 @@
-===== 7.2.34-9 (2021-10-20)
+===== 7.2.34-10 (2021-11-15)
-$ grep -r 'Tests failed' /var/lib/mock/{fc,el}*/build.log
+$ grep -r 'Tests failed' /var/lib/mock/*/build.log
/var/lib/mock/el7x/build.log:Tests failed : 0
/var/lib/mock/el8x72/build.logTests failed : 18
diff --git a/php-bug79971.patch b/php-bug79971.patch
new file mode 100644
index 0000000..9f31d28
--- /dev/null
+++ b/php-bug79971.patch
@@ -0,0 +1,167 @@
+From 2936b97fe42fb5713595a1559b91d568ccddb04a Mon Sep 17 00:00:00 2001
+From: "Christoph M. Becker" <cmbecker69@gmx.de>
+Date: Tue, 1 Sep 2020 10:04:28 +0200
+Subject: [PATCH 1/2] Fix #79971: special character is breaking the path in xml
+ function
+
+The libxml based XML functions accepting a filename actually accept
+URIs with possibly percent-encoded characters. Percent-encoded NUL
+bytes lead to truncation, like non-encoded NUL bytes would. We catch
+those, and let the functions fail with a respective warning.
+
+(cherry picked from commit f15f8fc573eb38c3c73e23e0930063a6f6409ed4)
+---
+ ext/dom/domimplementation.c | 5 +++++
+ ext/dom/tests/bug79971_2.phpt | 20 ++++++++++++++++++++
+ ext/libxml/libxml.c | 9 +++++++++
+ ext/simplexml/tests/bug79971_1.phpt | 27 +++++++++++++++++++++++++++
+ ext/simplexml/tests/bug79971_1.xml | 2 ++
+ 5 files changed, 63 insertions(+)
+ create mode 100644 ext/dom/tests/bug79971_2.phpt
+ create mode 100644 ext/simplexml/tests/bug79971_1.phpt
+ create mode 100644 ext/simplexml/tests/bug79971_1.xml
+
+diff --git a/ext/dom/domimplementation.c b/ext/dom/domimplementation.c
+index 28e35eb785..f4d1358b8e 100644
+--- a/ext/dom/domimplementation.c
++++ b/ext/dom/domimplementation.c
+@@ -114,6 +114,11 @@ PHP_METHOD(domimplementation, createDocumentType)
+ pch2 = (xmlChar *) systemid;
+ }
+
++ if (strstr(name, "%00")) {
++ php_error_docref(NULL, E_WARNING, "URI must not contain percent-encoded NUL bytes");
++ RETURN_FALSE;
++ }
++
+ uri = xmlParseURI(name);
+ if (uri != NULL && uri->opaque != NULL) {
+ localname = xmlStrdup((xmlChar *) uri->opaque);
+diff --git a/ext/dom/tests/bug79971_2.phpt b/ext/dom/tests/bug79971_2.phpt
+new file mode 100644
+index 0000000000..c4e6b1e4e0
+--- /dev/null
++++ b/ext/dom/tests/bug79971_2.phpt
+@@ -0,0 +1,20 @@
++--TEST--
++Bug #79971 (special character is breaking the path in xml function)
++--SKIPIF--
++<?php
++if (!extension_loaded('dom')) die('skip dom extension not available');
++?>
++--FILE--
++<?php
++$imp = new DOMImplementation;
++if (PHP_OS_FAMILY === 'Windows') {
++ $path = '/' . str_replace('\\', '/', __DIR__);
++} else {
++ $path = __DIR__;
++}
++$uri = "file://$path/bug79971_2.xml";
++var_dump($imp->createDocumentType("$uri%00foo"));
++?>
++--EXPECTF--
++Warning: DOMImplementation::createDocumentType(): URI must not contain percent-encoded NUL bytes in %s on line %d
++bool(false)
+diff --git a/ext/libxml/libxml.c b/ext/libxml/libxml.c
+index c871cb89bd..da553d64ee 100644
+--- a/ext/libxml/libxml.c
++++ b/ext/libxml/libxml.c
+@@ -308,6 +308,10 @@ static void *php_libxml_streams_IO_open_wrapper(const char *filename, const char
+ int isescaped=0;
+ xmlURI *uri;
+
++ if (strstr(filename, "%00")) {
++ php_error_docref(NULL, E_WARNING, "URI must not contain percent-encoded NUL bytes");
++ return NULL;
++ }
+
+ uri = xmlParseURI(filename);
+ if (uri && (uri->scheme == NULL ||
+@@ -438,6 +442,11 @@ php_libxml_output_buffer_create_filename(const char *URI,
+ if (URI == NULL)
+ return(NULL);
+
++ if (strstr(URI, "%00")) {
++ php_error_docref(NULL, E_WARNING, "URI must not contain percent-encoded NUL bytes");
++ return NULL;
++ }
++
+ puri = xmlParseURI(URI);
+ if (puri != NULL) {
+ if (puri->scheme != NULL)
+diff --git a/ext/simplexml/tests/bug79971_1.phpt b/ext/simplexml/tests/bug79971_1.phpt
+new file mode 100644
+index 0000000000..197776d82d
+--- /dev/null
++++ b/ext/simplexml/tests/bug79971_1.phpt
+@@ -0,0 +1,27 @@
++--TEST--
++Bug #79971 (special character is breaking the path in xml function)
++--SKIPIF--
++<?php
++if (!extension_loaded('simplexml')) die('skip simplexml extension not available');
++?>
++--FILE--
++<?php
++if (PHP_OS_FAMILY === 'Windows') {
++ $path = '/' . str_replace('\\', '/', __DIR__);
++} else {
++ $path = __DIR__;
++}
++$uri = "file://$path/bug79971_1.xml";
++var_dump(simplexml_load_file("$uri%00foo"));
++
++$sxe = simplexml_load_file($uri);
++var_dump($sxe->asXML("$uri.out%00foo"));
++?>
++--EXPECTF--
++Warning: simplexml_load_file(): URI must not contain percent-encoded NUL bytes in %s on line %d
++
++Warning: simplexml_load_file(): I/O warning : failed to load external entity "%s/bug79971_1.xml%00foo" in %s on line %d
++bool(false)
++
++Warning: SimpleXMLElement::asXML(): URI must not contain percent-encoded NUL bytes in %s on line %d
++bool(false)
+diff --git a/ext/simplexml/tests/bug79971_1.xml b/ext/simplexml/tests/bug79971_1.xml
+new file mode 100644
+index 0000000000..912bb76d9d
+--- /dev/null
++++ b/ext/simplexml/tests/bug79971_1.xml
+@@ -0,0 +1,2 @@
++<?xml version="1.0"?>
++<root></root>
+--
+2.31.1
+
+From c032381da0bfb6457aa9cfa7a430790f6eab8178 Mon Sep 17 00:00:00 2001
+From: Remi Collet <remi@remirepo.net>
+Date: Mon, 15 Nov 2021 09:05:33 +0100
+Subject: [PATCH 2/2] NEWS
+
+---
+ NEWS | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/NEWS b/NEWS
+index e5ecd3865a..2177c64aef 100644
+--- a/NEWS
++++ b/NEWS
+@@ -1,7 +1,13 @@
+ PHP NEWS
+ |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
+
+-Backported from 7.4.25
++Backported from 7.3.33
++
++- XML:
++ . Fix #79971: special character is breaking the path in xml function.
++ (CVE-2021-21707) (cmb)
++
++Backported from 7.3.32
+
+ - FPM:
+ . Fixed bug #81026 (PHP-FPM oob R/W in root process leading to privilege
+--
+2.31.1
+
diff --git a/php72.spec b/php72.spec
index 492122c..dd4075a 100644
--- a/php72.spec
+++ b/php72.spec
@@ -110,7 +110,7 @@
Summary: PHP scripting language for creating dynamic web sites
Name: php
Version: %{upver}%{?rcver:~%{rcver}}
-Release: 9%{?dist}
+Release: 10%{?dist}
# All files licensed under PHP version 3.01, except
# Zend is licensed under Zend
# TSRM is licensed under BSD
@@ -184,6 +184,7 @@ Patch203: php-bug81122.patch
Patch204: php-bug76450.patch
Patch205: php-bug81211.patch
Patch206: php-bug81026.patch
+Patch207: php-bug79971.patch
# Fixes for tests (300+)
# Factory is droped from system tzdata
@@ -1127,6 +1128,7 @@ low-level PHP extension for the libsodium cryptographic library.
%patch204 -p1 -b .bug76450
%patch205 -p1 -b .bug81211
%patch206 -p1 -b .bug81026
+%patch207 -p1 -b .bug79971
# Fixes for tests
%if 0%{?fedora} >= 25 || 0%{?rhel} >= 6
@@ -2240,6 +2242,10 @@ EOF
%changelog
+* Mon Nov 15 2021 Remi Collet <remi@remirepo.net> - 7.2.34-10
+- Fix #79971 special character is breaking the path in xml function
+ CVE-2021-21707
+
* Wed Oct 20 2021 Remi Collet <remi@remirepo.net> - 7.2.34-9
- fix PHP-FPM oob R/W in root process leading to priv escalation
CVE-2021-21703