php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.3'

Browse Source
This commit is contained in:
David Carlier
2024-07-01 22:38:05 +01:00
parent 2b2f755a11 20866b37aa
commit 66a06d6fa5
2 changed files with 57 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

56
ext/simplexml/simplexml.c
View File

@@ -1435,6 +1435,35 @@ static void sxe_add_namespaces(php_sxe_object *sxe, xmlNodePtr node, bool recurs
}
} /* }}} */
static inline void sxe_object_free_iterxpath(php_sxe_object *sxe)
{
if (!Z_ISUNDEF(sxe->iter.data)) {
zval_ptr_dtor(&sxe->iter.data);
ZVAL_UNDEF(&sxe->iter.data);
}
if (sxe->iter.name) {
efree(sxe->iter.name);
sxe->iter.name = NULL;
}
if (sxe->iter.nsprefix) {
efree(sxe->iter.nsprefix);
sxe->iter.nsprefix = NULL;
}
if (!Z_ISUNDEF(sxe->tmp)) {
zval_ptr_dtor(&sxe->tmp);
ZVAL_UNDEF(&sxe->tmp);
}
php_libxml_node_decrement_resource((php_libxml_node_object *)sxe);
if (sxe->xpath) {
xmlXPathFreeContext(sxe->xpath);
sxe->xpath = NULL;
}
}
/* {{{ Return all namespaces in use */
PHP_METHOD(SimpleXMLElement, getNamespaces)
{
@@ -2094,29 +2123,7 @@ static void sxe_object_free_storage(zend_object *object)
zend_object_std_dtor(&sxe->zo);
if (!Z_ISUNDEF(sxe->iter.data)) {
zval_ptr_dtor(&sxe->iter.data);
ZVAL_UNDEF(&sxe->iter.data);
}
if (sxe->iter.name) {
efree(sxe->iter.name);
sxe->iter.name = NULL;
}
if (sxe->iter.nsprefix) {
efree(sxe->iter.nsprefix);
sxe->iter.nsprefix = NULL;
}
if (!Z_ISUNDEF(sxe->tmp)) {
zval_ptr_dtor(&sxe->tmp);
ZVAL_UNDEF(&sxe->tmp);
}
php_libxml_node_decrement_resource((php_libxml_node_object *)sxe);
if (sxe->xpath) {
xmlXPathFreeContext(sxe->xpath);
}
sxe_object_free_iterxpath(sxe);
if (sxe->properties) {
zend_hash_destroy(sxe->properties);
@@ -2316,11 +2323,12 @@ PHP_METHOD(SimpleXMLElement, __construct)
PHP_LIBXML_RESTORE_GLOBALS(read_file_or_memory);
if (!docp) {
((php_libxml_node_object *)sxe)->document = NULL;
zend_throw_exception(zend_ce_exception, "String could not be parsed as XML", 0);
RETURN_THROWS();
}
sxe_object_free_iterxpath(sxe);
sxe->iter.nsprefix = ns_len ? (xmlChar*)estrdup(ns) : NULL;
sxe->iter.isprefix = isprefix;
php_libxml_increment_doc_ref((php_libxml_node_object *)sxe, docp);

25
ext/simplexml/tests/gh14638.phpt Normal file
View File

@@ -0,0 +1,25 @@
--TEST--
GH-14638: null pointer dereference on object cast __toString after failed XML parsing
--EXTENSIONS--
simplexml
--CREDITS--
YuanchengJiang
--FILE--
<?php
$xml = '<?xml version="1.0" encoding="utf-8" ?>
<test>
</test>';
$root = simplexml_load_string($xml);
try {
$root->__construct("malformed");
} catch (Exception $e) {
// Intentionally empty
}
echo $root;
?>
--EXPECTF--
Warning: SimpleXMLElement::__construct(): Entity: line 1: parser error : Start tag expected, '<' not found in %s on line %d
Warning: SimpleXMLElement::__construct(): malformed in %s on line %d
Warning: SimpleXMLElement::__construct(): ^ in %s on line %d