php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.4'

Browse Source 
* PHP-8.4:
  Fix GH-16535: UAF when using document as a child
  Fix GH-16533: Segfault when adding attribute to parent that is not an element
This commit is contained in:
Niels Dossche
2024-10-21 20:57:53 +02:00
parent 50acf5eb15 a0266920e4
commit 7c6c8e110e
3 changed files with 56 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
ext/dom/node.c
View File

@@ -864,6 +864,17 @@ static bool dom_node_check_legacy_insertion_validity(xmlNodePtr parentp, xmlNode
php_dom_throw_error(HIERARCHY_REQUEST_ERR, stricterror);
return false;
}
/* Attributes must be in elements. */
if (child->type == XML_ATTRIBUTE_NODE && parentp->type != XML_ELEMENT_NODE) {
php_dom_throw_error(HIERARCHY_REQUEST_ERR, stricterror);
return false;
}
/* Documents can never be a child. */
if (child->type == XML_DOCUMENT_NODE || child->type == XML_HTML_DOCUMENT_NODE) {
php_dom_throw_error(HIERARCHY_REQUEST_ERR, stricterror);
return false;
}
return true;
}

20
ext/dom/tests/gh16533.phpt Normal file
View File

@@ -0,0 +1,20 @@
--TEST--
GH-16533 (Segfault when adding attribute to parent that is not an element)
--EXTENSIONS--
dom
--FILE--
<?php
$doc = new DOMDocument();
try {
$doc->appendChild($doc->createAttribute('foo'));
} catch (DOMException $e) {
echo $e->getMessage(), "\n";
}
echo $doc->saveXML();
?>
--EXPECT--
Hierarchy Request Error
<?xml version="1.0"?>

25
ext/dom/tests/gh16535.phpt Normal file
View File

@@ -0,0 +1,25 @@
--TEST--
GH-16535 (UAF when using document as a child)
--EXTENSIONS--
dom
--FILE--
<?php
$v2 = new DOMDocument("t");
$v2->loadHTML("t");
$v4 = $v2->createElement('foo');
try {
$v4->appendChild($v2);
} catch (DOMException $e) {
echo $e->getMessage(), "\n";
}
$v2->loadHTML("oU");
echo $v2->saveXML();
?>
--EXPECT--
Hierarchy Request Error
<?xml version="1.0" standalone="yes"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html><body><p>oU</p></body></html>