$OpenBSD: patch-ext_xmlrpc_xmlrpc-epi-php_c,v 1.1 2010/08/08 10:46:34 sthen Exp $

CVE-2010-0397: null pointer dereference when processing invalid XML-RPC
requests, upstream r296152

--- ext/xmlrpc/xmlrpc-epi-php.c.orig	Sun Jan 17 17:19:38 2010
+++ ext/xmlrpc/xmlrpc-epi-php.c	Sat Aug  7 21:18:29 2010
@@ -723,6 +723,7 @@ zval* decode_request_worker (zval* xml_in, zval* encod
 	zval* retval = NULL;
 	XMLRPC_REQUEST response;
 	STRUCT_XMLRPC_REQUEST_INPUT_OPTIONS opts = {{0}};
+	const char *method_name;
 	opts.xml_elem_opts.encoding = encoding_in ? utf8_get_encoding_id_from_string(Z_STRVAL_P(encoding_in)) : ENCODING_DEFAULT;
 
 	/* generate XMLRPC_REQUEST from raw xml */
@@ -733,10 +734,15 @@ zval* decode_request_worker (zval* xml_in, zval* encod
 
 		if(XMLRPC_RequestGetRequestType(response) == xmlrpc_request_call) {
 			if(method_name_out) {
-				zval_dtor(method_name_out);
-				Z_TYPE_P(method_name_out) = IS_STRING;
-				Z_STRVAL_P(method_name_out) = estrdup(XMLRPC_RequestGetMethodName(response));
-				Z_STRLEN_P(method_name_out) = strlen(Z_STRVAL_P(method_name_out));
+				method_name = XMLRPC_RequestGetMethodName(response);
+				if (method_name) {
+					zval_dtor(method_name_out);
+					Z_TYPE_P(method_name_out) = IS_STRING;
+					Z_STRVAL_P(method_name_out) = estrdup(method_name);
+					Z_STRLEN_P(method_name_out) = strlen(Z_STRVAL_P(method_name_out));
+				} else {
+					retval = NULL;
+				}
 			}
 		}
 
