CVE-2016-9934 (Other, published 2017-01-04T20:59Z)
Description: value: ext/wddx/wddx.c in PHP before 5.6.28 and 7.x before 7.0.13 allows remote attackers to cause a denial of service (NULL pointer dereference) via crafted serialized data in a wddxPacket XML document, as demonstrated by a PDORow string.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/php/php-src
Files changed:
ext/pdo/pdo_stmt.c
ext/wddx/tests/bug45901.phpt
ext/wddx/tests/bug72790.phpt
ext/wddx/tests/bug73331.phpt
ext/wddx/wddx.c
Commit message: Fix bug #73331 - do not try to serialize/unserialize objects wddx can not handle

Proper soltion would be to call serialize/unserialize and deal with the result,
but this requires more work that should be done by wddx maintainer (not me).


Vulnerable code:
<wddxPacket version='1.0'><header><comment>Variables</comment></header><data><struct><var name='php_class_name'><string>SimpleXMLElement</string></var><var name='test'><struct><var name='php_class_name'><string>SimpleXMLElement</string></var></struct></var></struct></data></wddxPacket>
Bug 72790: wddx_deserialize null dereference with invalid xml

			PHP_CLASS_ATTRIBUTES;

			PHP_SET_CLASS_ATTRIBUTES(obj);

			PHP_CLEANUP_CLASS_ATTRIBUTES();

		PHP_CLASS_ATTRIBUTES;

		PHP_SET_CLASS_ATTRIBUTES(obj);

		PHP_CLEANUP_CLASS_ATTRIBUTES();

						/* Initialize target object */
						MAKE_STD_ZVAL(obj);
						object_init_ex(obj, *pce);

						/* Merge current hashtable with object's default properties */
						zend_hash_merge(Z_OBJPROP_P(obj),
										Z_ARRVAL_P(ent2->data),
										(void (*)(void *)) zval_add_ref,
										(void *) &tmp, sizeof(zval *), 0);

						if (incomplete_class) {
							php_store_class_name(obj, Z_STRVAL_P(ent1->data), Z_STRLEN_P(ent1->data));

						/* Clean up old array entry */
						zval_ptr_dtor(&ent2->data);

						/* Set stack entry to point to the newly created object */
						ent2->data = obj;


Fixed code:
	pdo_row_ce->unserialize = zend_class_unserialize_deny;

Warning: wddx_serialize_value(): Class SimpleXMLElement can not be serialized in %sbug45901.php on line %d
<wddxPacket version='1.0'><header><comment>Variables</comment></header><data></data></wddxPacket>
Bug #72790: wddx_deserialize null dereference with invalid xml
--TEST--
Bug #73331 (NULL Pointer Dereference in WDDX Packet Deserialization with PDORow)
--SKIPIF--
<?php if (!extension_loaded("wddx") || !extension_loaded("pdo")) print "skip"; ?>
--FILE--
<?php

$wddx = "<wddxPacket version='1.0'><header/><data><struct><var name='php_class_name'><string>PDORow</string></var></struct></data></wddxPacket>";
var_dump(wddx_deserialize($wddx));
?>
--EXPECTF--

Warning: wddx_deserialize(): Class pdorow can not be unserialized in %s73331.php on line %d
NULL

	zend_class_entry *ce;
	PHP_CLASS_ATTRIBUTES;
	PHP_SET_CLASS_ATTRIBUTES(obj);
	ce = Z_OBJCE_P(obj);
	if (!ce || ce->serialize || ce->unserialize) {
		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Class %s can not be serialized", class_name);
		PHP_CLEANUP_CLASS_ATTRIBUTES();
		return;
	}

	PHP_CLEANUP_CLASS_ATTRIBUTES();

						if (pce != &PHP_IC_ENTRY && ((*pce)->serialize || (*pce)->unserialize)) {
							ent2->data = NULL;
							php_error_docref(NULL TSRMLS_CC, E_WARNING, "Class %s can not be unserialized", Z_STRVAL_P(ent1->data));
						} else {
							/* Initialize target object */
							MAKE_STD_ZVAL(obj);
							object_init_ex(obj, *pce);

							/* Merge current hashtable with object's default properties */
							zend_hash_merge(Z_OBJPROP_P(obj),
											Z_ARRVAL_P(ent2->data),
											(void (*)(void *)) zval_add_ref,
											(void *) &tmp, sizeof(zval *), 0);

							if (incomplete_class) {
								php_store_class_name(obj, Z_STRVAL_P(ent1->data), Z_STRLEN_P(ent1->data));
							}

							/* Clean up old array entry */
							zval_ptr_dtor(&ent2->data);

							/* Set stack entry to point to the newly created object */
							ent2->data = obj;