Fix #79971 special character is breaking the path in xml function

  CVE-2021-21707

3 files changed, 176 insertions, 3 deletions

diff --git a/failed.txt b/failed.txt
index 87ad424..a097e55 100644
--- a/failed.txt
+++ b/failed.txt
@@ -1,6 +1,6 @@
-===== 7.2.34-9 (2021-10-20)
+===== 7.2.34-10 (2021-11-15)
 
-$ grep -ar 'Tests failed' /var/lib/mock/scl72*/build.log
+$ grep -ar 'Tests failed' /var/lib/mock/*/build.log
 
 /var/lib/mock/scl72el7x/build.log:Tests failed    :     0
 /var/lib/mock/scl72el8x/build.log:Tests failed    :    18
diff --git a/php-bug79971.patch b/php-bug79971.patch
new file mode 100644
index 0000000..9f31d28
--- /dev/null
+++ b/php-bug79971.patch
@@ -0,0 +1,167 @@
+From 2936b97fe42fb5713595a1559b91d568ccddb04a Mon Sep 17 00:00:00 2001
+From: "Christoph M. Becker" <cmbecker69@gmx.de>
+Date: Tue, 1 Sep 2020 10:04:28 +0200
+Subject: [PATCH 1/2] Fix #79971: special character is breaking the path in xml
+ function
+
+The libxml based XML functions accepting a filename actually accept
+URIs with possibly percent-encoded characters.  Percent-encoded NUL
+bytes lead to truncation, like non-encoded NUL bytes would.  We catch
+those, and let the functions fail with a respective warning.
+
+(cherry picked from commit f15f8fc573eb38c3c73e23e0930063a6f6409ed4)
+---
+ ext/dom/domimplementation.c         |  5 +++++
+ ext/dom/tests/bug79971_2.phpt       | 20 ++++++++++++++++++++
+ ext/libxml/libxml.c                 |  9 +++++++++
+ ext/simplexml/tests/bug79971_1.phpt | 27 +++++++++++++++++++++++++++
+ ext/simplexml/tests/bug79971_1.xml  |  2 ++
+ 5 files changed, 63 insertions(+)
+ create mode 100644 ext/dom/tests/bug79971_2.phpt
+ create mode 100644 ext/simplexml/tests/bug79971_1.phpt
+ create mode 100644 ext/simplexml/tests/bug79971_1.xml
+
+diff --git a/ext/dom/domimplementation.c b/ext/dom/domimplementation.c
+index 28e35eb785..f4d1358b8e 100644
+--- a/ext/dom/domimplementation.c
++++ b/ext/dom/domimplementation.c
+@@ -114,6 +114,11 @@ PHP_METHOD(domimplementation, createDocumentType)
+ 		pch2 = (xmlChar *) systemid;
+ 	}
+ 
++	if (strstr(name, "%00")) {
++		php_error_docref(NULL, E_WARNING, "URI must not contain percent-encoded NUL bytes");
++		RETURN_FALSE;
++	}
++
+ 	uri = xmlParseURI(name);
+ 	if (uri != NULL && uri->opaque != NULL) {
+ 		localname = xmlStrdup((xmlChar *) uri->opaque);
+diff --git a/ext/dom/tests/bug79971_2.phpt b/ext/dom/tests/bug79971_2.phpt
+new file mode 100644
+index 0000000000..c4e6b1e4e0
+--- /dev/null
++++ b/ext/dom/tests/bug79971_2.phpt
+@@ -0,0 +1,20 @@
++--TEST--
++Bug #79971 (special character is breaking the path in xml function)
++--SKIPIF--
++<?php
++if (!extension_loaded('dom')) die('skip dom extension not available');
++?>
++--FILE--
++<?php
++$imp = new DOMImplementation;
++if (PHP_OS_FAMILY === 'Windows') {
++    $path = '/' . str_replace('\\', '/', __DIR__);
++} else {
++    $path = __DIR__;
++}
++$uri = "file://$path/bug79971_2.xml";
++var_dump($imp->createDocumentType("$uri%00foo"));
++?>
++--EXPECTF--
++Warning: DOMImplementation::createDocumentType(): URI must not contain percent-encoded NUL bytes in %s on line %d
++bool(false)
+diff --git a/ext/libxml/libxml.c b/ext/libxml/libxml.c
+index c871cb89bd..da553d64ee 100644
+--- a/ext/libxml/libxml.c
++++ b/ext/libxml/libxml.c
+@@ -308,6 +308,10 @@ static void *php_libxml_streams_IO_open_wrapper(const char *filename, const char
+ 	int isescaped=0;
+ 	xmlURI *uri;
+ 
++	if (strstr(filename, "%00")) {
++		php_error_docref(NULL, E_WARNING, "URI must not contain percent-encoded NUL bytes");
++		return NULL;
++	}
+ 
+ 	uri = xmlParseURI(filename);
+ 	if (uri && (uri->scheme == NULL ||
+@@ -438,6 +442,11 @@ php_libxml_output_buffer_create_filename(const char *URI,
+ 	if (URI == NULL)
+ 		return(NULL);
+ 
++	if (strstr(URI, "%00")) {
++		php_error_docref(NULL, E_WARNING, "URI must not contain percent-encoded NUL bytes");
++		return NULL;
++	}
++
+ 	puri = xmlParseURI(URI);
+ 	if (puri != NULL) {
+ 		if (puri->scheme != NULL)
+diff --git a/ext/simplexml/tests/bug79971_1.phpt b/ext/simplexml/tests/bug79971_1.phpt
+new file mode 100644
+index 0000000000..197776d82d
+--- /dev/null
++++ b/ext/simplexml/tests/bug79971_1.phpt
+@@ -0,0 +1,27 @@
++--TEST--
++Bug #79971 (special character is breaking the path in xml function)
++--SKIPIF--
++<?php
++if (!extension_loaded('simplexml')) die('skip simplexml extension not available');
++?>
++--FILE--
++<?php
++if (PHP_OS_FAMILY === 'Windows') {
++    $path = '/' . str_replace('\\', '/', __DIR__);
++} else {
++    $path = __DIR__;
++}
++$uri = "file://$path/bug79971_1.xml";
++var_dump(simplexml_load_file("$uri%00foo"));
++
++$sxe = simplexml_load_file($uri);
++var_dump($sxe->asXML("$uri.out%00foo"));
++?>
++--EXPECTF--
++Warning: simplexml_load_file(): URI must not contain percent-encoded NUL bytes in %s on line %d
++
++Warning: simplexml_load_file(): I/O warning : failed to load external entity "%s/bug79971_1.xml%00foo" in %s on line %d
++bool(false)
++
++Warning: SimpleXMLElement::asXML(): URI must not contain percent-encoded NUL bytes in %s on line %d
++bool(false)
+diff --git a/ext/simplexml/tests/bug79971_1.xml b/ext/simplexml/tests/bug79971_1.xml
+new file mode 100644
+index 0000000000..912bb76d9d
+--- /dev/null
++++ b/ext/simplexml/tests/bug79971_1.xml
+@@ -0,0 +1,2 @@
++<?xml version="1.0"?>
++<root></root>
+-- 
+2.31.1
+
+From c032381da0bfb6457aa9cfa7a430790f6eab8178 Mon Sep 17 00:00:00 2001
+From: Remi Collet <remi@remirepo.net>
+Date: Mon, 15 Nov 2021 09:05:33 +0100
+Subject: [PATCH 2/2] NEWS
+
+---
+ NEWS | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/NEWS b/NEWS
+index e5ecd3865a..2177c64aef 100644
+--- a/NEWS
++++ b/NEWS
+@@ -1,7 +1,13 @@
+ PHP                                                                        NEWS
+ |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
+ 
+-Backported from 7.4.25
++Backported from 7.3.33
++
++- XML:
++  . Fix #79971: special character is breaking the path in xml function.
++    (CVE-2021-21707) (cmb)
++
++Backported from 7.3.32
+ 
+ - FPM:
+   . Fixed bug #81026 (PHP-FPM oob R/W in root process leading to privilege
+-- 
+2.31.1
+
diff --git a/php.spec b/php.spec
index 9c91f0b..5d43a96 100644
--- a/php.spec
+++ b/php.spec
@@ -126,7 +126,7 @@
 Summary: PHP scripting language for creating dynamic web sites
 Name: %{?scl_prefix}php
 Version: %{upver}%{?rcver:~%{rcver}}
-Release: 9%{?dist}
+Release: 10%{?dist}
 # All files licensed under PHP version 3.01, except
 # Zend is licensed under Zend
 # TSRM is licensed under BSD
@@ -199,6 +199,7 @@ Patch203: php-bug81122.patch
 Patch204: php-bug76450.patch
 Patch205: php-bug81211.patch
 Patch206: php-bug81026.patch
+Patch207: php-bug79971.patch
 
 # Fixes for tests (300+)
 # Factory is droped from system tzdata
@@ -969,6 +970,7 @@ sed -e 's/php-devel/%{?scl_prefix}php-devel/' -i scripts/phpize.in
 %patch204 -p1 -b .bug76450
 %patch205 -p1 -b .bug81211
 %patch206 -p1 -b .bug81026
+%patch207 -p1 -b .bug79971
 
 # Fixes for tests
 %patch300 -p1 -b .datetests
@@ -1939,6 +1941,10 @@ EOF
 
 
 %changelog
+* Mon Nov 15 2021 Remi Collet <remi@remirepo.net> - 7.2.34-10
+- Fix #79971 special character is breaking the path in xml function
+  CVE-2021-21707
+
 * Wed Oct 20 2021 Remi Collet <remi@remirepo.net> - 7.2.34-9
 - fix PHP-FPM oob R/W in root process leading to priv escalation
   CVE-2021-21703