diff --git a/NEWS b/NEWS index 5f70bd1ae03..b11b87830a9 100644 --- a/NEWS +++ b/NEWS @@ -17,6 +17,9 @@ PHP NEWS . Fixed bug #78923 (Artifacts when convoluting image with transparency). (wilson chen) +- Libxml: + . Fixed bug #79029 (Use After Free's in XMLReader / XMLWriter). (Laruence) + - Pcntl: . Fixed bug #78402 (Converting null to string in error message is bad DX). (SATŌ Kentarō) diff --git a/ext/libxml/libxml.c b/ext/libxml/libxml.c index b0b94b7c3a7..864e5a36fb7 100644 --- a/ext/libxml/libxml.c +++ b/ext/libxml/libxml.c @@ -358,6 +358,10 @@ static void *php_libxml_streams_IO_open_wrapper(const char *filename, const char context = php_stream_context_from_zval(Z_ISUNDEF(LIBXML(stream_context))? NULL : &LIBXML(stream_context), 0); ret_val = php_stream_open_wrapper_ex(path_to_open, (char *)mode, REPORT_ERRORS, NULL, context); + if (ret_val) { + /* Prevent from closing this by fclose() */ + ((php_stream*)ret_val)->flags |= PHP_STREAM_FLAG_NO_FCLOSE; + } if (isescaped) { xmlFree(resolved_path); } diff --git a/ext/xmlwriter/php_xmlwriter.c b/ext/xmlwriter/php_xmlwriter.c index 16545fd653b..24bb9dd1829 100644 --- a/ext/xmlwriter/php_xmlwriter.c +++ b/ext/xmlwriter/php_xmlwriter.c @@ -91,13 +91,15 @@ typedef int (*xmlwriter_read_int_t)(xmlTextWriterPtr writer); static void xmlwriter_free_resource_ptr(xmlwriter_object *intern) { if (intern) { - if (intern->ptr) { - xmlFreeTextWriter(intern->ptr); - intern->ptr = NULL; - } - if (intern->output) { - xmlBufferFree(intern->output); - intern->output = NULL; + if (EG(active)) { + if (intern->ptr) { + xmlFreeTextWriter(intern->ptr); + intern->ptr = NULL; + } + if (intern->output) { + xmlBufferFree(intern->output); + intern->output = NULL; + } } efree(intern); } diff --git a/ext/xmlwriter/tests/bug79029.phpt b/ext/xmlwriter/tests/bug79029.phpt new file mode 100644 index 00000000000..2e76a4e4095 --- /dev/null +++ b/ext/xmlwriter/tests/bug79029.phpt @@ -0,0 +1,34 @@ +--TEST-- +#79029 (Use After Free's in XMLReader / XMLWriter) +--SKIPIF-- + +--FILE-- +openUri("bug79029_1.txt"); +$x[0]->startComment(); + +$x = new XMLWriter(); +$x->openUri("bug79029_2.txt"); +fclose(@end(get_resources())); + +file_put_contents("bug79029_3.txt", "a"); +$x = new XMLReader(); +$x->open("bug79029_3.txt"); +fclose(@end(get_resources())); +?> +okey +--CLEAN-- + +--EXPECTF-- +Warning: fclose(): %d is not a valid stream resource in %sbug79029.php on line %d + +Warning: fclose(): %d is not a valid stream resource in %sbug79029.php on line %d +okey