php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix GH-16149: Null pointer dereference in DOMElement->getAttributeNames()

Browse Source 
A namespace without a prefix is by definition always the "xmlns"
namespace.

Closes GH-16155.
This commit is contained in:
Niels Dossche
2024-10-01 19:55:23 +02:00
parent 4a1694090b
commit 63e1ebe78d
3 changed files with 21 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
NEWS
View File

@@ -14,6 +14,8 @@ PHP NEWS
- DOM: - DOM:
. Fixed bug GH-16039 (Segmentation fault (access null pointer) in . Fixed bug GH-16039 (Segmentation fault (access null pointer) in
ext/dom/parentnode/tree.c). (nielsdos) ext/dom/parentnode/tree.c). (nielsdos)
. Fixed bug GH-16149 (Null pointer dereference in
DOMElement->getAttributeNames()). (nielsdos)
- JSON: - JSON:
. Fixed bug GH-15168 (stack overflow in json_encode()). (nielsdos) . Fixed bug GH-15168 (stack overflow in json_encode()). (nielsdos)

6
ext/dom/element.c
View File

@@ -339,7 +339,11 @@ PHP_METHOD(DOMElement, getAttributeNames)
for (xmlNsPtr nsptr = nodep->nsDef; nsptr; nsptr = nsptr->next) { for (xmlNsPtr nsptr = nodep->nsDef; nsptr; nsptr = nsptr->next) {
const char *prefix = (const char *) nsptr->prefix; const char *prefix = (const char *) nsptr->prefix;
ZVAL_STR(&tmp, dom_node_concatenated_name_helper(strlen(prefix), prefix, strlen("xmlns"), (const char *) "xmlns")); if (prefix == NULL) {
ZVAL_STRING(&tmp, "xmlns");
} else {
ZVAL_STR(&tmp, dom_node_concatenated_name_helper(strlen(prefix), prefix, strlen("xmlns"), (const char *) "xmlns"));
}
zend_hash_next_index_insert(ht, &tmp); zend_hash_next_index_insert(ht, &tmp);
} }

14
ext/dom/tests/gh16149.phpt Normal file
View File

@@ -0,0 +1,14 @@
--TEST--
GH-16149 (Null pointer dereference in DOMElement->getAttributeNames())
--EXTENSIONS--
dom
--FILE--
<?php
$element = new DOMElement("b", null, "a");
var_dump($element->getAttributeNames());
?>
--EXPECT--
array(1) {
[0]=>
string(5) "xmlns"
}