Debian Bug report logs - #883747
php7.0-xmlrpc: Wrong numeric entities convertion in xmlrpc_encode_request

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Mathieu Petit-Clair <mathieu@temlaz.ws>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: php7.0-xmlrpc: Wrong numeric entities convertion in xmlrpc_encode_request

Date: Thu, 07 Dec 2017 14:26:15 +0800

Package: php7.0-xmlrpc
Version: 7.0.26-1
Severity: normal

Dear Maintainer,

There is bug in the xmlrpc extension, when calling xmlrpc_encode() with
a range of characters.

To reproduce using php -a :

echo xmlrpc_encode('Π');

Result in sid:

<?xml version="1.0" encoding="utf-8"?>
<params>
<param>
 <value>
  <string>&#26;&#160;</string>
 </value>
</param>
</params>

Expected:

The value in <string>...</string> should be &#206;&#160; (note the extra
zero).

The good value can also be found on http://graphemica.com/%CE%A0 as the
"URL Escape Code", as seen in this URL and by
converting 206 to 0xCE and 160 to 0xA0.

We got the expected result by compiling PHP ourselves, which makes this
look like a Debian specific bug.

PHP bug 28597 - https://bugs.php.net/bug.php?id=28597 - provides a
solution to this issue, but does not appear to prevent it in this case.

Thanks for your help,


-- Package-specific info:
==== Additional PHP 7.0 information ====

++++ PHP @PHP_VERSION SAPI (php7.0query -S): ++++

++++ PHP 7.0 Extensions (php7.0query -M -v): ++++

++++ Configuration files: ++++
**** /etc/php/7.0/mods-available/xmlrpc.ini ****
extension=xmlrpc.so


-- System Information:
Debian Release: buster/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 4.14.0-1-amd64 (SMP w/8 CPU cores)
Locale: LANG=fr_CA.UTF-8, LC_CTYPE=fr_CA.UTF-8 (charmap=UTF-8), LANGUAGE=fr:en_GB (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages php7.0-xmlrpc depends on:
ii  libc6           2.25-3
ii  libxml2         2.9.4+dfsg1-5.1
ii  libxmlrpc-epi0  0.54.2-1.2
ii  php-common      1:56
ii  php7.0-common   7.0.26-1
ii  ucf             3.0036

php7.0-xmlrpc recommends no packages.

php7.0-xmlrpc suggests no packages.

Versions of packages php7.0-common depends on:
ii  libc6       2.25-3
ii  libssl1.1   1.1.0g-2
ii  php-common  1:56
ii  ucf         3.0036

Versions of packages php7.0-cli depends on:
ii  libc6            2.25-3
ii  libedit2         3.1-20170329-1
ii  libmagic1        1:5.32-1
ii  libpcre3         2:8.39-8
ii  libssl1.1        1.1.0g-2
ii  libxml2          2.9.4+dfsg1-5.1
ii  mime-support     3.60
ii  php7.0-common    7.0.26-1
ii  php7.0-json      7.0.26-1
ii  php7.0-opcache   7.0.26-1
ii  php7.0-readline  7.0.26-1
ii  tzdata           2017c-1
ii  ucf              3.0036
ii  zlib1g           1:1.2.8.dfsg-5

Versions of packages php7.0-cli suggests:
ii  php-pear  1:1.10.5+submodules+notgz-1

Versions of packages libapache2-mod-php7.0 depends on:
ii  apache2-bin [apache2-api-20120211]  2.4.29-1
ii  libc6                               2.25-3
ii  libmagic1                           1:5.32-1
ii  libpcre3                            2:8.39-8
ii  libssl1.1                           1.1.0g-2
ii  libxml2                             2.9.4+dfsg1-5.1
ii  mime-support                        3.60
ii  php7.0-cli                          7.0.26-1
ii  php7.0-common                       7.0.26-1
ii  php7.0-json                         7.0.26-1
ii  php7.0-opcache                      7.0.26-1
ii  tzdata                              2017c-1
ii  ucf                                 3.0036
ii  zlib1g                              1:1.2.8.dfsg-5

Versions of packages libapache2-mod-php7.0 recommends:
ii  apache2  2.4.29-1

Versions of packages libapache2-mod-php7.0 suggests:
ii  php-pear  1:1.10.5+submodules+notgz-1

-- no debconf information

Message #10 received at 883747@bugs.debian.org (full text, mbox, reply):

From: Mathieu Petit-Clair <mathieu@temlaz.ws>

To: 883747@bugs.debian.org

Subject: Debian links with xmlrpc-epi which is not patched

Date: Thu, 07 Dec 2017 16:17:01 +0800

Hi,

Upon further research, we see that PHP links with libxmlrpc-epi0, which 
does not have the patch mentionned earlier. The fix was not sent 
upstream apparently, so is only present in PHP's version.

I guess this bug could be reassigned to libxmlrpc-epi0, which could 
hopefully include PHP's patch.

Thanks,

Mathieu

Message #15 received at 883747@bugs.debian.org (full text, mbox, reply):

From: Lior Kaplan <kaplan@debian.org>

To: control@bugs.debian.org

Cc: 883747@bugs.debian.org

Subject: reassign #883747 to libxmlrpc-epi0

Date: Thu, 7 Dec 2017 10:47:34 +0200

[Message part 1 (text/plain, inline)]

reassign 883747 libxmlrpc-epi0  0.54.2-1.2
thanks

Patch used in PHP patch is at
https://github.com/php/php-src/commit/98a6986d97fd2d09fef2c4b870f6d77b5d29efe0

Kaplan

[Message part 2 (text/html, inline)]

Message #26 received at 883747@bugs.debian.org (full text, mbox, reply):

From: Thomas Zwirner <TZwirner@viosys.com>

To: "883747@bugs.debian.org" <883747@bugs.debian.org>

Subject: Debian links with libxmlrpc-epi0 which is still not patched

Date: Tue, 25 Sep 2018 09:33:30 +0200

Hi,

this bug is still present in actual Debian 9 libxmlrpc-epi0. To reproduce simply follow the steps above.

Used libxmlrpc-epi0:amd64 in version 0.54.2-1.2

Could you please fix this problem?

Send a report that this bug log contains spam.