php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.2' into PHP-8.3

Browse Source 
* PHP-8.2:
  Fix GH-16535: UAF when using document as a child
  Fix GH-16533: Segfault when adding attribute to parent that is not an element
This commit is contained in:
Niels Dossche
2024-10-21 20:56:46 +02:00
parent 713c71adbd 51b642f2c9
commit 5a09e0105e
4 changed files with 59 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
NEWS
View File

@@ -32,6 +32,9 @@ PHP NEWS
. Fixed bug GH-16336 (Attribute intern document mismanagement). (nielsdos)
. Fixed bug GH-16338 (Null-dereference in ext/dom/node.c). (nielsdos)
. Fixed bug GH-16473 (dom_import_simplexml stub is wrong). (nielsdos)
. Fixed bug GH-16533 (Segfault when adding attribute to parent that is not
an element). (nielsdos)
. Fixed bug GH-16535 (UAF when using document as a child). (nielsdos)
- EXIF:
. Fixed bug GH-16409 (Segfault in exif_thumbnail when not dealing with a

11
ext/dom/node.c
View File

@@ -969,6 +969,17 @@ static bool dom_node_check_legacy_insertion_validity(xmlNodePtr parentp, xmlNode
php_dom_throw_error(HIERARCHY_REQUEST_ERR, stricterror);
return false;
}
/* Attributes must be in elements. */
if (child->type == XML_ATTRIBUTE_NODE && parentp->type != XML_ELEMENT_NODE) {
php_dom_throw_error(HIERARCHY_REQUEST_ERR, stricterror);
return false;
}
/* Documents can never be a child. */
if (child->type == XML_DOCUMENT_NODE || child->type == XML_HTML_DOCUMENT_NODE) {
php_dom_throw_error(HIERARCHY_REQUEST_ERR, stricterror);
return false;
}
return true;
}

20
ext/dom/tests/gh16533.phpt Normal file
View File

@@ -0,0 +1,20 @@
--TEST--
GH-16533 (Segfault when adding attribute to parent that is not an element)
--EXTENSIONS--
dom
--FILE--
<?php
$doc = new DOMDocument();
try {
$doc->appendChild($doc->createAttribute('foo'));
} catch (DOMException $e) {
echo $e->getMessage(), "\n";
}
echo $doc->saveXML();
?>
--EXPECT--
Hierarchy Request Error
<?xml version="1.0"?>

25
ext/dom/tests/gh16535.phpt Normal file
View File

@@ -0,0 +1,25 @@
--TEST--
GH-16535 (UAF when using document as a child)
--EXTENSIONS--
dom
--FILE--
<?php
$v2 = new DOMDocument("t");
$v2->loadHTML("t");
$v4 = $v2->createElement('foo');
try {
$v4->appendChild($v2);
} catch (DOMException $e) {
echo $e->getMessage(), "\n";
}
$v2->loadHTML("oU");
echo $v2->saveXML();
?>
--EXPECT--
Hierarchy Request Error
<?xml version="1.0" standalone="yes"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html><body><p>oU</p></body></html>