php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.4'

Browse Source 
* PHP-8.4:
  Fix GH-18979: DOM\XMLDocument::createComment() triggers undefined behavior with null byte
This commit is contained in:
Niels Dossche
2025-07-01 18:51:31 +02:00
parent 50e1b23efb 1d5089e574
commit 30662e4e2b
2 changed files with 18 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
ext/dom/tests/modern/xml/gh18979.phpt Normal file
View File

@@ -0,0 +1,13 @@
--TEST--
GH-18979 (DOM\XMLDocument::createComment() triggers undefined behavior with null byte)
--EXTENSIONS--
dom
--FILE--
<?php
$dom = Dom\XMLDocument::createEmpty();
$container = $dom->createElement("container");
$container->append($dom->createComment("\0"));
var_dump($container->innerHTML);
?>
--EXPECT--
string(7) "<!---->"

6
ext/dom/xml_serializer.c
View File

@@ -640,7 +640,11 @@ static int dom_xml_serialize_comment_node(xmlOutputBufferPtr out, xmlNodePtr com
const xmlChar *ptr = comment->content;
if (ptr != NULL) {
TRY(dom_xml_check_char_production(ptr));
if (strstr((const char *) ptr, "--") != NULL || ptr[strlen((const char *) ptr) - 1] == '-') {
if (strstr((const char *) ptr, "--") != NULL) {
return -1;
}
size_t len = strlen((const char *) ptr);
if (len > 0 && ptr[len - 1] == '-') {
return -1;
}
}