Skip to content

Commit 7a67fb0

Browse files
nielsdosnielsdos
committed
Fix bug #62900: Wrong namespace on xsd import error message
The one error message indeed had a wrong namespace, and in general they weren't very descriptive, this also makes them more descriptive. Furthermore, two additional bugs were fixed: - Persistent memory leak of `location`. - UAF issues when printing the error message. Closes GH-15830.
1 parent 7e722e3 commit 7a67fb0

File tree

4 files changed

+123
-3
lines changed

4 files changed

+123
-3
lines changed

‎NEWS

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@ PHP NEWS
22
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
33
?? ??? ????, PHP 8.2.25
44

5+
- SOAP:
6+
. Fixed bug #62900 (Wrong namespace on xsd import error message). (nielsdos)
57

68
26 Sep 2024, PHP 8.2.24
79

‎ext/soap/php_schema.c

Lines changed: 24 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,13 @@ static encodePtr get_create_encoder(sdlPtr sdl, sdlTypePtr cur_type, const xmlCh
9292
return enc;
9393
}
9494

95+
/* Necessary for some error paths to avoid leaking persistent memory. */
96+
static void requestify_string(xmlChar **str) {
97+
xmlChar *copy = (xmlChar *) estrdup((const char *) *str);
98+
xmlFree(*str);
99+
*str = copy;
100+
}
101+
95102
static void schema_load_file(sdlCtx *ctx, xmlAttrPtr ns, xmlChar *location, xmlAttrPtr tns, int import) {
96103
if (location != NULL &&
97104
!zend_hash_str_exists(&ctx->docs, (char*)location, xmlStrlen(location))) {
@@ -104,22 +111,35 @@ static void schema_load_file(sdlCtx *ctx, xmlAttrPtr ns, xmlChar *location, xmlA
104111
sdl_restore_uri_credentials(ctx);
105112

106113
if (doc == NULL) {
114+
requestify_string(&location);
107115
soap_error1(E_ERROR, "Parsing Schema: can't import schema from '%s'", location);
108116
}
109117
schema = get_node(doc->children, "schema");
110118
if (schema == NULL) {
119+
requestify_string(&location);
111120
xmlFreeDoc(doc);
112121
soap_error1(E_ERROR, "Parsing Schema: can't import schema from '%s'", location);
113122
}
114123
new_tns = get_attribute(schema->properties, "targetNamespace");
115124
if (import) {
116125
if (ns != NULL && (new_tns == NULL || xmlStrcmp(ns->children->content, new_tns->children->content) != 0)) {
117-
xmlFreeDoc(doc);
118-
soap_error2(E_ERROR, "Parsing Schema: can't import schema from '%s', unexpected 'targetNamespace'='%s'", location, ns->children->content);
126+
requestify_string(&location);
127+
if (new_tns == NULL) {
128+
xmlFreeDoc(doc);
129+
soap_error2(E_ERROR, "Parsing Schema: can't import schema from '%s', missing 'targetNamespace', expected '%s'", location, ns->children->content);
130+
} else {
131+
/* Have to make a copy to avoid a UAF after freeing `doc` */
132+
const char *target_ns_copy = estrdup((const char *) new_tns->children->content);
133+
xmlFreeDoc(doc);
134+
soap_error3(E_ERROR, "Parsing Schema: can't import schema from '%s', unexpected 'targetNamespace'='%s', expected '%s'", location, target_ns_copy, ns->children->content);
135+
}
119136
}
120137
if (ns == NULL && new_tns != NULL) {
138+
requestify_string(&location);
139+
/* Have to make a copy to avoid a UAF after freeing `doc` */
140+
const char *target_ns_copy = estrdup((const char *) new_tns->children->content);
121141
xmlFreeDoc(doc);
122-
soap_error2(E_ERROR, "Parsing Schema: can't import schema from '%s', unexpected 'targetNamespace'='%s'", location, new_tns->children->content);
142+
soap_error2(E_ERROR, "Parsing Schema: can't import schema from '%s', unexpected 'targetNamespace'='%s', expected no 'targetNamespace'", location, target_ns_copy);
123143
}
124144
} else {
125145
new_tns = get_attribute(schema->properties, "targetNamespace");
@@ -128,6 +148,7 @@ static void schema_load_file(sdlCtx *ctx, xmlAttrPtr ns, xmlChar *location, xmlA
128148
xmlSetProp(schema, BAD_CAST("targetNamespace"), tns->children->content);
129149
}
130150
} else if (tns != NULL && xmlStrcmp(tns->children->content, new_tns->children->content) != 0) {
151+
requestify_string(&location);
131152
xmlFreeDoc(doc);
132153
soap_error1(E_ERROR, "Parsing Schema: can't include schema from '%s', different 'targetNamespace'", location);
133154
}

‎ext/soap/tests/bugs/bug62900.phpt

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
--TEST--
2+
Bug #62900 (Wrong namespace on xsd import error message)
3+
--EXTENSIONS--
4+
soap
5+
--INI--
6+
soap.wsdl_cache_enabled=0
7+
--FILE--
8+
<?php
9+
10+
$wsdl_with_ns = <<<XML
11+
<definitions xmlns="http://schemas.xmlsoap.org/wsdl/" xmlns:xs="http://www.w3.org/2001/XMLSchema" targetNamespace="http://test-uri">
12+
<types>
13+
<xs:schema targetNamespace="http://test-uri" elementFormDefault="qualified">
14+
<import namespace="http://www.w3.org/XML/1998/namespace" schemaLocation="bug62900.xsd" />
15+
</xs:schema>
16+
</types>
17+
</definitions>
18+
XML;
19+
20+
$wsdl_without_ns = <<<XML
21+
<definitions xmlns="http://schemas.xmlsoap.org/wsdl/" xmlns:xs="http://www.w3.org/2001/XMLSchema" targetNamespace="http://test-uri">
22+
<types>
23+
<xs:schema elementFormDefault="qualified">
24+
<import schemaLocation="bug62900.xsd" />
25+
</xs:schema>
26+
</types>
27+
</definitions>
28+
XML;
29+
30+
$xsd_with_wrong_ns = <<<XML
31+
<!DOCTYPE xs:schema PUBLIC "-//W3C//DTD XMLSCHEMA 200102//EN" "XMLSchema.dtd">
32+
<xs:schema targetNamespace="http://www.w3.org/XML/1998/namespacex" xmlns:xs="http://www.w3.org/2001/XMLSchema" xml:lang="en"/>
33+
XML;
34+
35+
$xsd_without_ns = <<<XML
36+
<!DOCTYPE xs:schema PUBLIC "-//W3C//DTD XMLSCHEMA 200102//EN" "XMLSchema.dtd">
37+
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" xml:lang="en"/>
38+
XML;
39+
40+
$combinations = [
41+
[$wsdl_with_ns, $xsd_with_wrong_ns],
42+
[$wsdl_with_ns, $xsd_without_ns],
43+
[$wsdl_without_ns, $xsd_with_wrong_ns],
44+
[$wsdl_without_ns, $xsd_without_ns],
45+
];
46+
47+
chdir(__DIR__);
48+
49+
$args = ["-d", "display_startup_errors=0", "-d", "extension_dir=" . ini_get("extension_dir"), "-d", "extension=" . (substr(PHP_OS, 0, 3) == "WIN" ? "php_" : "") . "soap." . PHP_SHLIB_SUFFIX];
50+
if (php_ini_loaded_file()) {
51+
// Necessary such that it works from a development directory in which case extension_dir might not be the real extension dir
52+
$args[] = "-c";
53+
$args[] = php_ini_loaded_file();
54+
}
55+
56+
foreach ($combinations as list($wsdl, $xsd)) {
57+
file_put_contents(__DIR__."/bug62900.wsdl", $wsdl);
58+
file_put_contents(__DIR__."/bug62900.xsd", $xsd);
59+
60+
$proc = proc_open([PHP_BINARY, ...$args, __DIR__.'/bug62900_run'], [1 => ["pipe", "w"], 2 => ["pipe", "w"]], $pipes);
61+
echo stream_get_contents($pipes[1]);
62+
fclose($pipes[1]);
63+
proc_close($proc);
64+
}
65+
66+
?>
67+
--CLEAN--
68+
<?php
69+
@unlink(__DIR__."/bug62900.wsdl");
70+
@unlink(__DIR__."/bug62900.xsd");
71+
?>
72+
--EXPECTF--
73+
Fatal error: Uncaught SoapFault exception: [WSDL] SOAP-ERROR: Parsing Schema: can't import schema from '%sbug62900.xsd', unexpected 'targetNamespace'='http://www.w3.org/XML/1998/namespacex', expected 'http://www.w3.org/XML/1998/namespace' in %s:%d
74+
Stack trace:
75+
#0 %s(%d): SoapClient->__construct(%s)
76+
#1 {main}
77+
thrown in %s on line %d
78+
79+
Fatal error: Uncaught SoapFault exception: [WSDL] SOAP-ERROR: Parsing Schema: can't import schema from '%sbug62900.xsd', missing 'targetNamespace', expected 'http://www.w3.org/XML/1998/namespace' in %s:%d
80+
Stack trace:
81+
#0 %s(%d): SoapClient->__construct(%s)
82+
#1 {main}
83+
thrown in %s on line %d
84+
85+
Fatal error: Uncaught SoapFault exception: [WSDL] SOAP-ERROR: Parsing Schema: can't import schema from '%sbug62900.xsd', unexpected 'targetNamespace'='http://www.w3.org/XML/1998/namespacex', expected no 'targetNamespace' in %s:%d
86+
Stack trace:
87+
#0 %s(%d): SoapClient->__construct(%s)
88+
#1 {main}
89+
thrown in %s on line %d
90+
91+
Fatal error: Uncaught SoapFault exception: [WSDL] SOAP-ERROR: Parsing WSDL: Couldn't bind to service in %s:%d
92+
Stack trace:
93+
#0 %s(%d): SoapClient->__construct(%s)
94+
#1 {main}
95+
thrown in %s on line %d

‎ext/soap/tests/bugs/bug62900_run

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
<?php
2+
new SoapClient(__DIR__."/bug62900.wsdl");

0 commit comments

Comments
 (0)