diff --git a/lib/SimpleSAML/Bindings/SAML20/HTTPRedirect.php b/lib/SimpleSAML/Bindings/SAML20/HTTPRedirect.php index a060f4defc986eb44d24ad1523782753375987d0..295d852c6092789acb988c1d7f65ec4a738bb316 100644 --- a/lib/SimpleSAML/Bindings/SAML20/HTTPRedirect.php +++ b/lib/SimpleSAML/Bindings/SAML20/HTTPRedirect.php @@ -241,7 +241,17 @@ class SimpleSAML_Bindings_SAML20_HTTPRedirect { $relaystate = NULL; } - $samlRequestXML = gzinflate(base64_decode( $rawRequest )); + $decodedRequest = @base64_decode($rawRequest, TRUE); + if (!$decodedRequest) { + throw new Exception('Could not base64 decode SAMLRequest GET parameter'); + } + + $samlRequestXML = @gzinflate($decodedRequest); + if (!$samlRequestXML) { + $error = error_get_last(); + throw new Exception('Could not gzinflate base64 decoded SAMLRequest: ' . $error['message'] ); + } + $samlRequest = new SimpleSAML_XML_SAML20_LogoutRequest($this->configuration, $this->metadata); @@ -269,7 +279,17 @@ class SimpleSAML_Bindings_SAML20_HTTPRedirect { $relaystate = NULL; } - $samlRequestXML = gzinflate(base64_decode( $rawRequest )); + $decodedRequest = @base64_decode($rawRequest, TRUE); + if (!$decodedRequest) { + throw new Exception('Could not base64 decode SAMLRequest GET parameter'); + } + + $samlRequestXML = @gzinflate($decodedRequest); + if (!$samlRequestXML) { + $error = error_get_last(); + throw new Exception('Could not gzinflate base64 decoded SAMLRequest: ' . $error['message'] ); + } + $samlRequest = new SimpleSAML_XML_SAML20_LogoutResponse($this->configuration, $this->metadata);