CVE-2016-7132: NULL Pointer Dereference (CWE-476)
value: ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via an invalid wddxPacket XML document that is mishandled in a wddx_deserialize call, as demonstrated by a stray element inside a boolean element, leading to incorrect pop processing.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2016-09-12T01:59Z
Repository: https://github.com/php/php-src
Language: Other
Files changed: ext/wddx/tests/bug72790.phpt, ext/wddx/tests/bug72799.phpt, ext/wddx/wddx.c
Commit date: 2016-08-16 12:46:29 +0200
Commit message: Fix for bug #72790 and bug #72799

(cherry picked from commit a14fdb9746262549bbbb96abb87338bacd147e1b)

Conflicts:
	ext/wddx/wddx.c

Diff: diff --git a/ext/wddx/tests/bug72790.phpt b/ext/wddx/tests/bug72790.phpt
new file mode 100644
index 00000000000..a60524bdaf1
--- /dev/null
+++ b/ext/wddx/tests/bug72790.phpt
@@ -0,0 +1,35 @@
+--TEST--
+Bug 72790: wddx_deserialize null dereference with invalid xml
+--SKIPIF--
+<?php
+if (!extension_loaded('wddx')) {
+    die('skip. wddx not available');
+}
+?>
+--FILE--
+<?php
+
+$xml = <<< XML
+<?xml version='1.0' ?>
+<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
+<wddxPacket version='1.0'>
+        |array>
+                <var name="XXXX">
+                        <boolean value="this">
+                        </boolean>
+                </var>
+                <var name="YYYY">
+                        <var name="UUUU">
+                                <var name="EZEZ">
+                                </var>
+                        </var>
+                </var>
+        </array>
+</wddxPacket>
+XML;
+
+$array = wddx_deserialize($xml);
+var_dump($array);
+?>
+--EXPECT--
+NULL
\ No newline at end of file
diff --git a/ext/wddx/tests/bug72799.phpt b/ext/wddx/tests/bug72799.phpt
new file mode 100644
index 00000000000..5861d5538f4
--- /dev/null
+++ b/ext/wddx/tests/bug72799.phpt
@@ -0,0 +1,28 @@
+--TEST--
+Bug #72799: wddx_deserialize null dereference in php_wddx_pop_element
+--SKIPIF--
+<?php
+if (!extension_loaded('wddx')) {
+    die('skip. wddx not available');
+}
+?>
+--FILE--
+<?php
+
+$xml = <<<XML
+<?xml version='1.0'?>
+<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
+<wddxPacket version="1.0">
+    <var name="XXXX">
+        <boolean value="1">
+            <dateTime>1998-06-12T04:32:12+00</dateTime>
+        </boolean>
+    </var>
+</wddxPacket>
+XML;
+
+$array = wddx_deserialize($xml);
+var_dump($array);
+?>
+--EXPECT--
+NULL
\ No newline at end of file
diff --git a/ext/wddx/wddx.c b/ext/wddx/wddx.c
index d28cb7a0acb..11cf0be62e3 100644
--- a/ext/wddx/wddx.c
+++ b/ext/wddx/wddx.c
@@ -884,14 +884,14 @@ static void php_wddx_pop_element(void *user_data, const XML_Char *name)
 		wddx_stack_top(stack, (void**)&ent1);
 
 		if (Z_TYPE(ent1->data) == IS_UNDEF) {
 			if (stack->top > 1) {
 				stack->top--;
+				efree(ent1);
 			} else {
 				stack->done = 1;
 			}
-			efree(ent1);
 			return;
 		}
 
 		if (!strcmp((char *)name, EL_BINARY)) {
 			zend_string *new_str = php_base64_decode(

Vulnerable code: 			efree(ent1);
Fixed code: --TEST--
Bug 72790: wddx_deserialize null dereference with invalid xml
--SKIPIF--
<?php
if (!extension_loaded('wddx')) {
    die('skip. wddx not available');
}
?>
--FILE--
<?php

$xml = <<< XML
<?xml version='1.0' ?>
<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
<wddxPacket version='1.0'>
        |array>
                <var name="XXXX">
                        <boolean value="this">
                        </boolean>
                </var>
                <var name="YYYY">
                        <var name="UUUU">
                                <var name="EZEZ">
                                </var>
                        </var>
                </var>
        </array>
</wddxPacket>
XML;

$array = wddx_deserialize($xml);
var_dump($array);
?>
--EXPECT--
NULL
--TEST--
Bug #72799: wddx_deserialize null dereference in php_wddx_pop_element
--SKIPIF--
<?php
if (!extension_loaded('wddx')) {
    die('skip. wddx not available');
}
?>
--FILE--
<?php

$xml = <<<XML
<?xml version='1.0'?>
<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
<wddxPacket version="1.0">
    <var name="XXXX">
        <boolean value="1">
            <dateTime>1998-06-12T04:32:12+00</dateTime>
        </boolean>
    </var>
</wddxPacket>
XML;

$array = wddx_deserialize($xml);
var_dump($array);
?>
--EXPECT--
NULL
				efree(ent1);