[GIT-PULLS] [php-src] PR #22761: ext/soap: fix NULL deref on malformed HTTP status line
[email protected] (iliaal) Thu, 16 Jul 2026 12:31:41 +0000
| Newsgroups | php.git-pulls |
|---|---|
| Message-ID | <[email protected]> |
Pull Request: https://github.com/php/php-src/pull/22761 Author: iliaal `make_http_soap_request()` looks for the reason phrase with strstr(tmp, " ") even when the first strstr() found no space. A status line carrying a version but no status code, such as "HTTP/1.1", leaves tmp NULL, so strstr() dereferences it and the client segfaults. A broken or hostile SOAP endpoint can crash the client talking to it. The test drives a SoapClient against a socket answering "HTTP/1.1\r\nContent-Type: text/xml\r\nContent-Length: 0\r\n\r\n" and asserts __doRequest() returns an empty string. Present on 8.3 through master, targeting 8.4 as the lowest actively supported branch.