php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.2' into PHP-8.3

Browse Source 
* PHP-8.2:
  Fix GH-14702: DOMDocument::xinclude() crash
This commit is contained in:
Niels Dossche
2024-06-28 22:22:12 +02:00
parent 41371900a8 42908f9f68
commit 0a1f51deb3
3 changed files with 123 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
NEWS
View File

@@ -9,6 +9,9 @@ PHP NEWS
. Fixed bug GH-14590 (Memory leak in FPM test gh13563-conf-bool-env.phpt.
(nielsdos)
- Dom:
. Fixed bug GH-14702 (DOMDocument::xinclude() crash). (nielsdos)
- Phar:
. Fixed bug GH-14603 (null string from zip entry).
(David Carlier)

54
ext/dom/document.c
View File

@@ -1625,6 +1625,58 @@ static void php_dom_remove_xinclude_nodes(xmlNodePtr cur) /* {{{ */
}
/* }}} */
/* Backported from master branch xml_common.h */
static zend_always_inline xmlNodePtr php_dom_next_in_tree_order(const xmlNode *nodep, const xmlNode *basep)
{
if (nodep->type == XML_ELEMENT_NODE && nodep->children) {
return nodep->children;
}
if (nodep->next) {
return nodep->next;
} else {
/* Go upwards, until we find a parent node with a next sibling, or until we hit the base. */
do {
nodep = nodep->parent;
if (nodep == basep) {
return NULL;
}
} while (nodep->next == NULL);
return nodep->next;
}
}
static void dom_xinclude_strip_references(xmlNodePtr basep)
{
php_libxml_node_free_resource(basep);
xmlNodePtr current = basep->children;
while (current) {
php_libxml_node_free_resource(current);
current = php_dom_next_in_tree_order(current, basep);
}
}
/* See GH-14702.
* We have to remove userland references to xinclude fallback nodes because libxml2 will make clones of these
* and remove the original nodes. If the originals are removed while there are still userland references
* this will cause memory corruption. */
static void dom_xinclude_strip_fallback_references(const xmlNode *basep)
{
xmlNodePtr current = basep->children;
while (current) {
if (current->type == XML_ELEMENT_NODE && current->ns != NULL && current->_private != NULL
&& xmlStrEqual(current->name, XINCLUDE_FALLBACK)
&& (xmlStrEqual(current->ns->href, XINCLUDE_NS) || xmlStrEqual(current->ns->href, XINCLUDE_OLD_NS))) {
dom_xinclude_strip_references(current);
}
current = php_dom_next_in_tree_order(current, basep);
}
}
/* {{{ Substitutues xincludes in a DomDocument */
PHP_METHOD(DOMDocument, xinclude)
{
@@ -1647,6 +1699,8 @@ PHP_METHOD(DOMDocument, xinclude)
DOM_GET_OBJ(docp, id, xmlDocPtr, intern);
dom_xinclude_strip_fallback_references((const xmlNode *) docp);
PHP_LIBXML_SANITIZE_GLOBALS(xinclude);
err = xmlXIncludeProcessFlags(docp, (int)flags);
PHP_LIBXML_RESTORE_GLOBALS(xinclude);

66
ext/dom/tests/gh14702.phpt Normal file
View File

@@ -0,0 +1,66 @@
--TEST--
GH-14702 (DOMDocument::xinclude() crash)
--EXTENSIONS--
dom
--FILE--
<?php
$doc = new DOMDocument();
$doc->loadXML(<<<XML
<?xml version="1.0"?>
<root>
<child/>
<include href="foo" xmlns="http://www.w3.org/2001/XInclude">
<fallback/>
</include>
<keep/>
</root>
XML);
$xi = $doc->createElementNS('http://www.w3.org/2001/XInclude', 'xi:include');
$xi->setAttribute('href', 'nonexistent');
$fallback = $doc->createElementNS('http://www.w3.org/2001/XInclude', 'xi:fallback');
$xi->appendChild($fallback);
$child1 = $fallback->appendChild($doc->createElement('fallback-child1'));
$child2 = $fallback->appendChild($doc->createElement('fallback-child2'));
$xpath = new DOMXPath($doc);
$toReplace = $xpath->query('//child')->item(0);
$toReplace->parentNode->replaceChild($xi, $toReplace);
$keep = $doc->documentElement->lastElementChild;
var_dump(@$doc->xinclude());
echo $doc->saveXML();
var_dump($child1, $child2, $fallback, $keep->nodeName);
$keep->textContent = 'still works';
echo $doc->saveXML();
?>
--EXPECT--
int(2)
<?xml version="1.0"?>
<root>
<fallback-child1/><fallback-child2/>
<keep/>
</root>
object(DOMElement)#4 (1) {
["schemaTypeInfo"]=>
NULL
}
object(DOMElement)#5 (1) {
["schemaTypeInfo"]=>
NULL
}
object(DOMElement)#3 (1) {
["schemaTypeInfo"]=>
NULL
}
string(4) "keep"
<?xml version="1.0"?>
<root>
<fallback-child1/><fallback-child2/>
<keep>still works</keep>
</root>