php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix GH-20722: Null pointer dereference in DOM namespace node cloning via clone on malformed objects

Browse Source 
Closes GH-20730.
This commit is contained in:
Niels Dossche
2025-12-18 20:37:04 +01:00
parent 7c1830b056
commit 983be089c0
3 changed files with 24 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
NEWS
View File

@@ -13,6 +13,10 @@ PHP NEWS
. Fixed bug GH-20620 (bzcompress overflow on large source size). . Fixed bug GH-20620 (bzcompress overflow on large source size).
(David Carlier) (David Carlier)
- DOM:
. Fixed bug GH-20722 (Null pointer dereference in DOM namespace node cloning
via clone on malformed objects). (ndossche)
- GD: - GD:
. Fixed bug GH-20622 (imagestring/imagestringup overflow). (David Carlier) . Fixed bug GH-20622 (imagestring/imagestringup overflow). (David Carlier)

12
ext/dom/php_dom.c
View File

@@ -541,15 +541,17 @@ static zend_object *dom_object_namespace_node_clone_obj(zend_object *zobject)
zend_object *clone = dom_objects_namespace_node_new(intern->dom.std.ce); zend_object *clone = dom_objects_namespace_node_new(intern->dom.std.ce);
dom_object_namespace_node *clone_intern = php_dom_namespace_node_obj_from_obj(clone); dom_object_namespace_node *clone_intern = php_dom_namespace_node_obj_from_obj(clone);
xmlNodePtr original_node = dom_object_get_node(&intern->dom);
ZEND_ASSERT(original_node->type == XML_NAMESPACE_DECL);
xmlNodePtr cloned_node = php_dom_create_fake_namespace_decl_node_ptr(original_node->parent, original_node->ns);
if (intern->parent_intern) { if (intern->parent_intern) {
clone_intern->parent_intern = intern->parent_intern; clone_intern->parent_intern = intern->parent_intern;
GC_ADDREF(&clone_intern->parent_intern->std); GC_ADDREF(&clone_intern->parent_intern->std);
} }
dom_update_refcount_after_clone(&intern->dom, original_node, &clone_intern->dom, cloned_node);
xmlNodePtr original_node = dom_object_get_node(&intern->dom);
if (original_node != NULL) {
ZEND_ASSERT(original_node->type == XML_NAMESPACE_DECL);
xmlNodePtr cloned_node = php_dom_create_fake_namespace_decl_node_ptr(original_node->parent, original_node->ns);
dom_update_refcount_after_clone(&intern->dom, original_node, &clone_intern->dom, cloned_node);
}
zend_objects_clone_members(clone, &intern->dom.std); zend_objects_clone_members(clone, &intern->dom.std);
return clone; return clone;

13
ext/dom/tests/gh20722.phpt Normal file
View File

@@ -0,0 +1,13 @@
--TEST--
GH-20722 (Null pointer dereference in DOM namespace node cloning via clone on malformed objects)
--EXTENSIONS--
dom
--FILE--
<?php
clone new DOMNameSpaceNode();
echo "Done";
?>
--EXPECT--
Done