php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.4' into PHP-8.5

Browse Source 
* PHP-8.4:
  Fix GH-20722: Null pointer dereference in DOM namespace node cloning via clone on malformed objects
This commit is contained in:
Niels Dossche
2025-12-18 22:40:02 +01:00
parent 874727b41f bf63341f35
commit 735f354ac9
3 changed files with 24 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
NEWS
View File

@@ -9,6 +9,10 @@ PHP NEWS
malformed INI input via parse_ini_string()). (ndossche)
. Fixed bug GH-20714 (Uncatchable exception thrown in generator). (ilutov)
- DOM:
. Fixed bug GH-20722 (Null pointer dereference in DOM namespace node cloning
via clone on malformed objects). (ndossche)
- EXIF:
. Fixed bug GH-20631 (Integer underflow in exif HEIF parsing
when pos.size < 2). (Oblivionsage)

12
ext/dom/php_dom.c
View File

@@ -714,15 +714,17 @@ static zend_object *dom_object_namespace_node_clone_obj(zend_object *zobject)
zend_object *clone = dom_objects_namespace_node_new(intern->dom.std.ce);
dom_object_namespace_node *clone_intern = php_dom_namespace_node_obj_from_obj(clone);
xmlNodePtr original_node = dom_object_get_node(&intern->dom);
ZEND_ASSERT(original_node->type == XML_NAMESPACE_DECL);
xmlNodePtr cloned_node = php_dom_create_fake_namespace_decl_node_ptr(original_node->parent, original_node->ns);
if (intern->parent_intern) {
clone_intern->parent_intern = intern->parent_intern;
GC_ADDREF(&clone_intern->parent_intern->std);
}
dom_update_refcount_after_clone(&intern->dom, original_node, &clone_intern->dom, cloned_node);
xmlNodePtr original_node = dom_object_get_node(&intern->dom);
if (original_node != NULL) {
ZEND_ASSERT(original_node->type == XML_NAMESPACE_DECL);
xmlNodePtr cloned_node = php_dom_create_fake_namespace_decl_node_ptr(original_node->parent, original_node->ns);
dom_update_refcount_after_clone(&intern->dom, original_node, &clone_intern->dom, cloned_node);
}
zend_objects_clone_members(clone, &intern->dom.std);
return clone;

13
ext/dom/tests/gh20722.phpt Normal file
View File

@@ -0,0 +1,13 @@
--TEST--
GH-20722 (Null pointer dereference in DOM namespace node cloning via clone on malformed objects)
--EXTENSIONS--
dom
--FILE--
<?php
clone new DOMNameSpaceNode();
echo "Done";
?>
--EXPECT--
Done