Bug #2471

Bad regex for integers leads to fatal error

Details

Submitted	2004-10-06 18:49 UTC
From	cl-pear at ex-parrot dot com
Assigned	ssb
Status	Closed
Package	XML_RPC
PHP Version	4.3.8
OS	linux
Roadmaps	(Not assigned)

Comments

[2004-10-06 18:49 UTC] cl-pear at ex-parrot dot com

Description:
------------
A value such as <int>+1</int> in a response is not parsed correctly, and instead yields a fatal error in PHP: "Call to a member function on a non-object in /software/lib/php/XML/RPC.php on line 274".

For once this is actually specified in the spec at <http://www.xmlrpc.com/spec>, which says, "An integer is a 32-bit signed number. You can include a plus or minus at the beginning of a string of numeric characters. Leading zeros are collapsed. Whitespace is not permitted. Just numeric characters preceeded by a plus or minus."

Reproduce code:
---------------
any call to ->send(...) on an XML_RPC_Client object. One possible patch is here:

--- XML_RPC.php.orig Wed Oct 6 19:42:42 2004
+++ XML_RPC.php Wed Oct 6 19:43:09 2004
@@ -269,7 +269,7 @@
} else {
// we have an I4, INT or a DOUBLE
// we must check that only 0123456789-.<space> are characters here
- if (!ereg("^\-?[0123456789 \t\.]+$", $XML_RPC_xh[$parser]['ac'])) {
+ if (!ereg("^[+-]?[0123456789 \t\.]+$", $XML_RPC_xh[$parser]['ac'])) {
$this->raiseError("Non-numeric value recieved in INT or DOUBLE", XML_RPC_ERROR_NON_NUMERIC_FOUND);
$XML_RPC_xh[$parser]['st'] .= "ERROR_NON_NUMERIC_FOUND";
} else {

-- arguably that regex shouldn't have whitespace in it -- see quote from spec, above.

Expected result:
----------------
Result of XMLRPC call returned.

Actual result:
--------------
PHP fatal error.