Skip to content

Commit f4c45ee

Browse files
committed
ext/ldap: Fix GH-16032 (Various NULL pointer dereferencements in ldap_modify_batch())
We check that the "attrib" and "modtype" keys are present in each array. If not we throw a ValueError, in line with what other validation failure cases do. Closes GH-16057
1 parent 043b9e1 commit f4c45ee

File tree

4 files changed

+70
-0
lines changed

4 files changed

+70
-0
lines changed

NEWS

+4
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,10 @@ PHP NEWS
1616
. Fixed bug GH-16039 (Segmentation fault (access null pointer) in
1717
ext/dom/parentnode/tree.c). (nielsdos)
1818

19+
- LDAP:
20+
. Fixed bug GH-16032 (Various NULL pointer dereferencements in
21+
ldap_modify_batch()). (Girgias)
22+
1923
- PHPDBG:
2024
. Fixed bug GH-15901 (phpdbg: Assertion failure on i funcs). (cmb)
2125

ext/ldap/ldap.c

+14
Original file line numberDiff line numberDiff line change
@@ -2544,8 +2544,11 @@ PHP_FUNCTION(ldap_modify_batch)
25442544
/* for the modification hashtable... */
25452545
zend_hash_internal_pointer_reset(Z_ARRVAL_P(mod));
25462546
num_modprops = zend_hash_num_elements(Z_ARRVAL_P(mod));
2547+
bool has_attrib_key = false;
2548+
bool has_modtype_key = false;
25472549

25482550
for (j = 0; j < num_modprops; j++) {
2551+
25492552
/* are the keys strings? */
25502553
if (zend_hash_get_current_key(Z_ARRVAL_P(mod), &modkey, &tmpUlong) != HASH_KEY_IS_STRING) {
25512554
zend_argument_type_error(3, "must only contain string-indexed arrays");
@@ -2567,6 +2570,7 @@ PHP_FUNCTION(ldap_modify_batch)
25672570

25682571
/* does the value type match the key? */
25692572
if (_ldap_str_equal_to_const(ZSTR_VAL(modkey), ZSTR_LEN(modkey), LDAP_MODIFY_BATCH_ATTRIB)) {
2573+
has_attrib_key = true;
25702574
if (Z_TYPE_P(modinfo) != IS_STRING) {
25712575
zend_type_error("%s(): Option \"" LDAP_MODIFY_BATCH_ATTRIB "\" must be of type string, %s given", get_active_function_name(), zend_zval_type_name(modinfo));
25722576
RETURN_THROWS();
@@ -2578,6 +2582,7 @@ PHP_FUNCTION(ldap_modify_batch)
25782582
}
25792583
}
25802584
else if (_ldap_str_equal_to_const(ZSTR_VAL(modkey), ZSTR_LEN(modkey), LDAP_MODIFY_BATCH_MODTYPE)) {
2585+
has_modtype_key = true;
25812586
if (Z_TYPE_P(modinfo) != IS_LONG) {
25822587
zend_type_error("%s(): Option \"" LDAP_MODIFY_BATCH_MODTYPE "\" must be of type int, %s given", get_active_function_name(), zend_zval_type_name(modinfo));
25832588
RETURN_THROWS();
@@ -2641,6 +2646,15 @@ PHP_FUNCTION(ldap_modify_batch)
26412646

26422647
zend_hash_move_forward(Z_ARRVAL_P(mod));
26432648
}
2649+
2650+
if (!has_attrib_key) {
2651+
zend_value_error("%s(): Required option \"" LDAP_MODIFY_BATCH_ATTRIB "\" is missing", get_active_function_name());
2652+
RETURN_THROWS();
2653+
}
2654+
if (!has_modtype_key) {
2655+
zend_value_error("%s(): Required option \"" LDAP_MODIFY_BATCH_MODTYPE "\" is missing", get_active_function_name());
2656+
RETURN_THROWS();
2657+
}
26442658
}
26452659
}
26462660
/* validation was successful */

ext/ldap/tests/gh16032-1.phpt

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
--TEST--
2+
Bug GH-16032: Various NULL pointer dereferencements in ldap_modify_batch()
3+
--EXTENSIONS--
4+
ldap
5+
--FILE--
6+
<?php
7+
8+
/* We are assuming 3333 is not connectable */
9+
$ldap = ldap_connect('ldap://127.0.0.1:3333');
10+
$valid_dn = "cn=userA,something";
11+
12+
$modification_missing_attrib_key = [
13+
[
14+
"modtype" => LDAP_MODIFY_BATCH_ADD,
15+
"values" => ["value1"],
16+
],
17+
];
18+
try {
19+
var_dump(ldap_modify_batch($ldap, $valid_dn, $modification_missing_attrib_key));
20+
} catch (Throwable $e) {
21+
echo $e::class, ': ', $e->getMessage(), PHP_EOL;
22+
}
23+
24+
?>
25+
--EXPECT--
26+
ValueError: ldap_modify_batch(): Required option "attrib" is missing

ext/ldap/tests/gh16032-2.phpt

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
--TEST--
2+
Bug GH-16032: Various NULL pointer dereferencements in ldap_modify_batch()
3+
--EXTENSIONS--
4+
ldap
5+
--FILE--
6+
<?php
7+
8+
/* We are assuming 3333 is not connectable */
9+
$ldap = ldap_connect('ldap://127.0.0.1:3333');
10+
$valid_dn = "cn=userA,something";
11+
12+
$modification_missing_modtype_key = [
13+
[
14+
"attrib" => "attrib1",
15+
"values" => ["value1"],
16+
],
17+
];
18+
try {
19+
var_dump(ldap_modify_batch($ldap, $valid_dn, $modification_missing_modtype_key));
20+
} catch (Throwable $e) {
21+
echo $e::class, ': ', $e->getMessage(), PHP_EOL;
22+
}
23+
24+
?>
25+
--EXPECT--
26+
ValueError: ldap_modify_batch(): Required option "modtype" is missing

0 commit comments

Comments
 (0)