[Bug 1657158] [NEW] Invalid encoding of UTF8 strings in PHP7 XMLRPC functions

[Atis]

*** This bug is a security vulnerability ***

Public security bug reported:

UTF-8 characters are incorrectly encoded. 208 character code turns into
28, and 209 turns into 29, etc

Vanilla php 7 does not have this problem:

 PHP 7.0.14 (cli) (built: Jan 17 2017 14:51:10) ( NTS )
 PHP 5.3.10 did not had this problem.

Problem has been reproduced on versions:

 PHP 7.0.14 (cli) (built: Jan 17 2017 14:51:10) ( NTS )
 PHP 7.0.8-0ubuntu0.16.04.3 (cli) ( NTS )
 PHP 7.1.0-5+deb.sury.org~xenial+1 (cli) ( NTS )

Test script:
---------------
<?php

print_r(xmlrpc_encode('Москва'));

Expected result:
----------------
<?xml version="1.0" 
encoding="utf-8"?><params><param><value><string>&#208;&#156;&#208;&#190;&#209;&#129;&#208;&#186;&#208;&#178;&#208;&#176;</string></value></param></params>

Actual result:
--------------
<?xml version="1.0" encoding="utf-8"?><params><param><value>  
<string>&#28;&#156;&#28;&#190;&#29;&#129;&#28;&#186;&#28;&#178;&#28;&#176;</string></value></param></params>

** Affects: php7.0 (Ubuntu)
     Importance: Undecided
         Status: New

** Information type changed from Public to Public Security

** Description changed:

-                                                        
- UTF-8 characters are incorrectly encoded. 208 character code turns into 28, 
and 209 turns into 29, etc
+ UTF-8 characters are incorrectly encoded. 208 character code turns into
+ 28, and 209 turns into 29, etc
  
  Vanilla php 7 does not have this problem:
  
-  PHP 7.0.14 (cli) (built: Jan 17 2017 14:51:10) ( NTS )
-  PHP 5.3.10 did not had this problem.
+  PHP 7.0.14 (cli) (built: Jan 17 2017 14:51:10) ( NTS )
+  PHP 5.3.10 did not had this problem.
  
  Problem has been reproduced on versions:
  
-  PHP 7.0.14 (cli) (built: Jan 17 2017 14:51:10) ( NTS )                       
                                                                              
PHP 7.0.8-0ubuntu0.16.04.3 (cli) ( NTS )
-  PHP 7.1.0-5+deb.sury.org~xenial+1 (cli) ( NTS )
- 
+  PHP 7.0.14 (cli) (built: Jan 17 2017 14:51:10) ( NTS )
+  PHP 7.0.8-0ubuntu0.16.04.3 (cli) ( NTS )
+  PHP 7.1.0-5+deb.sury.org~xenial+1 (cli) ( NTS )
  
  Test script:
  ---------------
  <?php
  
  print_r(xmlrpc_encode('Москва'));
  
  Expected result:
  ----------------
  <?xml version="1.0" 
encoding="utf-8"?><params><param><value><string>&#208;&#156;&#208;&#190;&#209;&#129;&#208;&#186;&#208;&#178;&#208;&#176;</string></value></param></params>
  
  Actual result:
  --------------
  <?xml version="1.0" encoding="utf-8"?><params><param><value>  
<string>&#28;&#156;&#28;&#190;&#29;&#129;&#28;&#186;&#28;&#178;&#28;&#176;</string></value></param></params>

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1657158

Title:
  Invalid encoding of UTF8 strings in PHP7 XMLRPC functions

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/php7.0/+bug/1657158/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs