CVE-2016-7398 (published 2019-09-06T19:15Z)

A type confusion vulnerability in the merge_param() function of php_http_params.c in PHP's pecl-http extension 3.1.0beta2 (PHP 7) and earlier as well as 2.6.0beta2 (PHP 5) and earlier allows attackers to crash PHP and possibly execute arbitrary code via crafted HTTP requests.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-704
cwe_name: Incorrect Type Conversion or Cast
description: The product does not correctly convert an object, resource, or structure from one type to a different type.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/m6w6/ext-http
commit_details: repo_url: https://github.com/m6w6/ext-http
author: Michael Wallner
author_date: 2016-09-12 08:24:54+02:00
msg: fix bug #73055
repository: repo_url: https://github.com/m6w6/ext-http
repo_name: m6w6/ext-http
description: Extended HTTP Support
repo_language: C
owner: m6w6
file_changes: filename: .gitignore
change_type: ModificationType.MODIFY
diff: @@ -42,3 +42,36 @@ lcov_data
 *.phar
 vendor/
 tests/helper/server.log
+php_http_api.h
+php_http_buffer.h
+php_http_client.h
+php_http_client_curl.h
+php_http_client_curl_event.h
+php_http_client_curl_user.h
+php_http_client_request.h
+php_http_client_response.h
+php_http_cookie.h
+php_http_curl.h
+php_http_encoding.h
+php_http_env.h
+php_http_env_request.h
+php_http_env_response.h
+php_http_etag.h
+php_http_exception.h
+php_http_filter.h
+php_http_header.h
+php_http_header_parser.h
+php_http_info.h
+php_http_message.h
+php_http_message_body.h
+php_http_message_parser.h
+php_http_misc.h
+php_http_negotiate.h
+php_http_object.h
+php_http_options.h
+php_http_params.h
+php_http_querystring.h
+php_http_response_codes.h
+php_http_url.h
+php_http_utf8.h
+php_http_version.h

programming_language: Shell
filename: package.xml
change_type: ModificationType.MODIFY
diff: @@ -31,9 +31,9 @@ https://mdref.m6w6.name/http
   <email>mike@php.net</email>
   <active>yes</active>
  </lead>
- <date>2016-09-07</date>
+ <date>2016-09-12</date>
  <version>
-  <release>2.6.0beta2</release>
+  <release>2.6.0RC1</release>
   <api>2.6.0</api>
  </version>
  <stability>
@@ -69,6 +69,10 @@ https://mdref.m6w6.name/http
 Changes from beta1:
 * Fixed PHP-5.3 compatibility
 * Fixed recursive calls to the event loop dispatcher
+
+Changes from beta2:
+* Fix bug #73055: crash in http\QueryString (Mike, @rc0r)
+* Fix HTTP/2 version parser for older libcurl versions (Mike)
 ]]></notes>
  <contents>
   <dir name="/">
@@ -185,6 +189,7 @@ Changes from beta1:
      <file role="test" name="bug69313.phpt"/>
      <file role="test" name="bug69357.phpt"/>
      <file role="test" name="bug71719.phpt"/>
+     <file role="test" name="bug73055.phpt"/>
      <file role="test" name="client001.phpt"/>
      <file role="test" name="client002.phpt"/>
      <file role="test" name="client003.phpt"/>

programming_language: PHP
filename: php_http_params.c
change_type: ModificationType.MODIFY
diff: @@ -470,7 +470,7 @@ static void merge_param(HashTable *params, zval *zdata, zval ***current_param, z
 			while (Z_TYPE_PP(zdata_ptr) == IS_ARRAY
 			&&	SUCCESS == zend_hash_get_current_data(Z_ARRVAL_PP(zdata_ptr), (void *) &test_ptr)
 			) {
-				if (Z_TYPE_PP(test_ptr) == IS_ARRAY) {
+				if (Z_TYPE_PP(test_ptr) == IS_ARRAY && Z_TYPE_PP(ptr) == IS_ARRAY) {
 
 					/* now find key in ptr */
 					if (HASH_KEY_IS_STRING == zend_hash_get_current_key_ex(Z_ARRVAL_PP(zdata_ptr), &hkey.str, &hkey.len, &hkey.num, hkey.dup, NULL)) {

programming_language: C