php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fixed bug #79029 (Use After Free's in XMLReader / XMLWriter).

Browse Source 
We backport the fix PHP 7.3, since this branch is affected as well.

(cherry picked from commit b5e0043796)
(cherry picked from commit e36daa6927)
(cherry picked from commit 2704ee6844)
This commit is contained in:
Xinchen Hui
2019-12-25 12:05:44 +01:00
committed by Christoph M. Becker
parent 37d11d123e
commit 27bb3289ac
4 changed files with 50 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
NEWS
View File

@@ -17,6 +17,9 @@ PHP NEWS
. Fixed bug #78923 (Artifacts when convoluting image with transparency).
(wilson chen)
- Libxml:
. Fixed bug #79029 (Use After Free's in XMLReader / XMLWriter). (Laruence)
- Pcntl:
. Fixed bug #78402 (Converting null to string in error message is bad DX).
(SATŌ Kentarō)

4
ext/libxml/libxml.c
View File

@@ -358,6 +358,10 @@ static void *php_libxml_streams_IO_open_wrapper(const char *filename, const char
context = php_stream_context_from_zval(Z_ISUNDEF(LIBXML(stream_context))? NULL : &LIBXML(stream_context), 0);
ret_val = php_stream_open_wrapper_ex(path_to_open, (char *)mode, REPORT_ERRORS, NULL, context);
if (ret_val) {
/* Prevent from closing this by fclose() */
((php_stream*)ret_val)->flags |= PHP_STREAM_FLAG_NO_FCLOSE;
}
if (isescaped) {
xmlFree(resolved_path);
}

16
ext/xmlwriter/php_xmlwriter.c
View File

@@ -91,13 +91,15 @@ typedef int (*xmlwriter_read_int_t)(xmlTextWriterPtr writer);
static void xmlwriter_free_resource_ptr(xmlwriter_object *intern)
{
if (intern) {
if (intern->ptr) {
xmlFreeTextWriter(intern->ptr);
intern->ptr = NULL;
}
if (intern->output) {
xmlBufferFree(intern->output);
intern->output = NULL;
if (EG(active)) {
if (intern->ptr) {
xmlFreeTextWriter(intern->ptr);
intern->ptr = NULL;
}
if (intern->output) {
xmlBufferFree(intern->output);
intern->output = NULL;
}
}
efree(intern);
}

34
ext/xmlwriter/tests/bug79029.phpt Normal file
View File

@@ -0,0 +1,34 @@
--TEST--
#79029 (Use After Free's in XMLReader / XMLWriter)
--SKIPIF--
<?php
if (!extension_loaded("xmlwriter")) print "skip xmlwriter extension not available";
if (!extension_loaded("xmlreader")) print "skip xmlreader extension not available";
?>
--FILE--
<?php
$x = array( new XMLWriter() );
$x[0]->openUri("bug79029_1.txt");
$x[0]->startComment();
$x = new XMLWriter();
$x->openUri("bug79029_2.txt");
fclose(@end(get_resources()));
file_put_contents("bug79029_3.txt", "a");
$x = new XMLReader();
$x->open("bug79029_3.txt");
fclose(@end(get_resources()));
?>
okey
--CLEAN--
<?php
@unlink("bug79029_1.txt");
@unlink("bug79029_2.txt");
@unlink("bug79029_3.txt");
?>
--EXPECTF--
Warning: fclose(): %d is not a valid stream resource in %sbug79029.php on line %d
Warning: fclose(): %d is not a valid stream resource in %sbug79029.php on line %d
okey