php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

lexbor: Cherry pick "URL: fixed "use-after-poison" for an empty path entry."

Browse Source 
see lexbor/lexbor@9259b169e3

Fixes php/php-src#20502
Fixes php/php-src#20521
This commit is contained in:
Tim Düsterhus
2025-11-18 17:30:51 +01:00
parent f558ae5204
commit 7610527d75
2 changed files with 19 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
NEWS
View File

@@ -25,6 +25,8 @@ PHP NEWS
- Lexbor:
. Fixed bug GH-20501 (\Uri\WhatWg\Url lose host after calling
withPath() or withQuery()). (lexborisov)
. Fixed bug GH-20502 (\Uri\WhatWg\Url crashes (SEGV) when parsing
malformed URL due to Lexbor memory corruption). (lexborisov)
- Opcache:
. Fixed bug GH-20329 (opcache.file_cache broken with full interned string

27
ext/lexbor/lexbor/url/url.c
View File

@@ -1029,27 +1029,34 @@ lxb_url_path_append_wo_slash(lxb_url_t *url,
static lxb_status_t
lxb_url_path_append(lxb_url_t *url, const lxb_char_t *data, size_t length)
{
size_t len;
lxb_char_t *p;
lxb_char_t *p, *begin;
lexbor_str_t *str;
str = &url->path.str;
if (str->data == NULL) {
p = lexbor_str_init(str, url->mraw, length + 1);
if (p == NULL) {
return LXB_STATUS_ERROR_MEMORY_ALLOCATION;
}
}
else {
/* + 2 == begin '/' and end '\0' */
p = lexbor_str_check_size(str, url->mraw, length + 2);
}
len = str->length;
str->length += 1;
if (p == NULL) {
return LXB_STATUS_ERROR_MEMORY_ALLOCATION;
}
p = lexbor_str_append(&url->path.str, url->mraw, data, length);
begin = &str->data[str->length];
begin[0] = '/';
str->data[len] = '/';
if (length > 0) {
memcpy(&begin[1], data, sizeof(lxb_char_t) * length);
}
return (p != NULL) ? LXB_STATUS_OK : LXB_STATUS_ERROR_MEMORY_ALLOCATION;
str->length += length + 1;
str->data[str->length] = '\0';
return LXB_STATUS_OK;
}
static lxb_status_t