CVE-2016-7398: Incorrect Type Conversion or Cast (CWE-704)
value: A type confusion vulnerability in the merge_param() function of php_http_params.c in PHP's pecl-http extension 3.1.0beta2 (PHP 7) and earlier as well as 2.6.0beta2 (PHP 5) and earlier allows attackers to crash PHP and possibly execute arbitrary code via crafted HTTP requests.
CWE description: The product does not correctly convert an object, resource, or structure from one type to a different type.
CVSS v3 base score: 9.8
Published: 2019-09-06T19:15Z
Repository: https://github.com/m6w6/ext-http
Language: Other
Files changed: .gitignore, package.xml, src/php_http_params.c
Commit date: 2016-09-12 08:24:54 +0200
Commit message: fix bug #73055

Diff: diff --git a/.gitignore b/.gitignore
index 33cd7c6..45ac1a5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -40,5 +40,38 @@ tests/*.sh
 lcov_data
 *~
 *.phar
 vendor/
 tests/helper/server.log
+php_http_api.h
+php_http_buffer.h
+php_http_client.h
+php_http_client_curl.h
+php_http_client_curl_event.h
+php_http_client_curl_user.h
+php_http_client_request.h
+php_http_client_response.h
+php_http_cookie.h
+php_http_curl.h
+php_http_encoding.h
+php_http_env.h
+php_http_env_request.h
+php_http_env_response.h
+php_http_etag.h
+php_http_exception.h
+php_http_filter.h
+php_http_header.h
+php_http_header_parser.h
+php_http_info.h
+php_http_message.h
+php_http_message_body.h
+php_http_message_parser.h
+php_http_misc.h
+php_http_negotiate.h
+php_http_object.h
+php_http_options.h
+php_http_params.h
+php_http_querystring.h
+php_http_response_codes.h
+php_http_url.h
+php_http_utf8.h
+php_http_version.h
diff --git a/package.xml b/package.xml
index 0e22066..7191f31 100644
--- a/package.xml
+++ b/package.xml
@@ -29,13 +29,13 @@ https://mdref.m6w6.name/http
   <name>Michael Wallner</name>
   <user>mike</user>
   <email>mike@php.net</email>
   <active>yes</active>
  </lead>
- <date>2016-09-07</date>
+ <date>2016-09-12</date>
  <version>
-  <release>2.6.0beta2</release>
+  <release>2.6.0RC1</release>
   <api>2.6.0</api>
  </version>
  <stability>
   <release>beta</release>
   <api>stable</api>
@@ -67,10 +67,14 @@ https://mdref.m6w6.name/http
 * Fix gh-issue #31: add/improve configure checks for default CA bundle/path (Mike, @rcanavan) 
 
 Changes from beta1:
 * Fixed PHP-5.3 compatibility
 * Fixed recursive calls to the event loop dispatcher
+
+Changes from beta2:
+* Fix bug #73055: crash in http\QueryString (Mike, @rc0r)
+* Fix HTTP/2 version parser for older libcurl versions (Mike)
 ]]></notes>
  <contents>
   <dir name="/">
    <file role="doc" name="AUTHORS"/>
    <file role="doc" name="BUGS"/>
@@ -183,10 +187,11 @@ Changes from beta1:
      <file role="test" name="bug69000.phpt"/>
      <file role="test" name="bug69076.phpt"/>
      <file role="test" name="bug69313.phpt"/>
      <file role="test" name="bug69357.phpt"/>
      <file role="test" name="bug71719.phpt"/>
+     <file role="test" name="bug73055.phpt"/>
      <file role="test" name="client001.phpt"/>
      <file role="test" name="client002.phpt"/>
      <file role="test" name="client003.phpt"/>
      <file role="test" name="client004.phpt"/>
      <file role="test" name="client005.phpt"/>
diff --git a/src/php_http_params.c b/src/php_http_params.c
index fc75f0e..9071068 100644
--- a/src/php_http_params.c
+++ b/src/php_http_params.c
@@ -468,11 +468,11 @@ static void merge_param(HashTable *params, zval *zdata, zval ***current_param, z
 			zval **test_ptr;
 
 			while (Z_TYPE_PP(zdata_ptr) == IS_ARRAY
 			&&	SUCCESS == zend_hash_get_current_data(Z_ARRVAL_PP(zdata_ptr), (void *) &test_ptr)
 			) {
-				if (Z_TYPE_PP(test_ptr) == IS_ARRAY) {
+				if (Z_TYPE_PP(test_ptr) == IS_ARRAY && Z_TYPE_PP(ptr) == IS_ARRAY) {
 
 					/* now find key in ptr */
 					if (HASH_KEY_IS_STRING == zend_hash_get_current_key_ex(Z_ARRVAL_PP(zdata_ptr), &hkey.str, &hkey.len, &hkey.num, hkey.dup, NULL)) {
 						if (SUCCESS == zend_hash_find(Z_ARRVAL_PP(ptr), hkey.str, hkey.len, (void *) &ptr)) {
 							zdata_ptr = test_ptr;

Vulnerable code:  <date>2016-09-07</date>
  <release>2.6.0beta2</release>
				if (Z_TYPE_PP(test_ptr) == IS_ARRAY) {
Fixed code: php_http_api.h
php_http_buffer.h
php_http_client.h
php_http_client_curl.h
php_http_client_curl_event.h
php_http_client_curl_user.h
php_http_client_request.h
php_http_client_response.h
php_http_cookie.h
php_http_curl.h
php_http_encoding.h
php_http_env.h
php_http_env_request.h
php_http_env_response.h
php_http_etag.h
php_http_exception.h
php_http_filter.h
php_http_header.h
php_http_header_parser.h
php_http_info.h
php_http_message.h
php_http_message_body.h
php_http_message_parser.h
php_http_misc.h
php_http_negotiate.h
php_http_object.h
php_http_options.h
php_http_params.h
php_http_querystring.h
php_http_response_codes.h
php_http_url.h
php_http_utf8.h
php_http_version.h
 <date>2016-09-12</date>
  <release>2.6.0RC1</release>

Changes from beta2:
* Fix bug #73055: crash in http\QueryString (Mike, @rc0r)
* Fix HTTP/2 version parser for older libcurl versions (Mike)
     <file role="test" name="bug73055.phpt"/>
				if (Z_TYPE_PP(test_ptr) == IS_ARRAY && Z_TYPE_PP(ptr) == IS_ARRAY) {