archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'PHP-8.3'

Browse source 
* PHP-8.3:
  Fix crashes with entity references and predefined entities
This commit is contained in:
Niels Dossche 2024-01-17 19:41:32 +01:00
commit 043daeeec1
3 changed files with 101 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

43
ext/libxml/libxml.c
View file

@ -200,12 +200,36 @@ static void php_libxml_node_free(xmlNodePtr node)
* dtd is attached to the document. This works around the issue by inspecting the parent directly. */
case XML_ENTITY_DECL: {
xmlEntityPtr entity = (xmlEntityPtr) node;
php_libxml_unlink_entity_decl(entity);
if (entity->orig != NULL) {
xmlFree((char *) entity->orig);
entity->orig = NULL;
if (entity->etype != XML_INTERNAL_PREDEFINED_ENTITY) {
php_libxml_unlink_entity_decl(entity);
#if LIBXML_VERSION >= 21200
xmlFreeEntity(entity);
#else
if (entity->children != NULL && entity->owner && entity == (xmlEntityPtr) entity->children->parent) {
xmlFreeNodeList(entity->children);
}
xmlDictPtr dict = entity->doc != NULL ? entity->doc->dict : NULL;
if (dict == NULL || !xmlDictOwns(dict, entity->name)) {
xmlFree((xmlChar *) entity->name);
}
if (dict == NULL || !xmlDictOwns(dict, entity->ExternalID)) {
xmlFree((xmlChar *) entity->ExternalID);
}
if (dict == NULL || !xmlDictOwns(dict, entity->SystemID)) {
xmlFree((xmlChar *) entity->SystemID);
}
if (dict == NULL || !xmlDictOwns(dict, entity->URI)) {
xmlFree((xmlChar *) entity->URI);
}
if (dict == NULL || !xmlDictOwns(dict, entity->content)) {
xmlFree(entity->content);
}
if (dict == NULL || !xmlDictOwns(dict, entity->orig)) {
xmlFree(entity->orig);
}
xmlFree(entity);
#endif
}
xmlFreeNode(node);
break;
}
case XML_NOTATION_NODE: {
@ -1376,6 +1400,15 @@ PHP_LIBXML_API void php_libxml_node_free_resource(xmlNodePtr node)
case XML_DOCUMENT_NODE:
case XML_HTML_DOCUMENT_NODE:
break;
case XML_ENTITY_REF_NODE:
/* Entity reference nodes are special: their children point to entity declarations,
* but they don't own the declarations and therefore shouldn't free the children.
* Moreover, there can be more than one reference node for a single entity declarations. */
php_libxml_unregister_node(node);
if (node->parent == NULL) {
php_libxml_node_free(node);
}
break;
default:
if (node->parent == NULL || node->type == XML_NAMESPACE_DECL) {
php_libxml_node_free_list((xmlNodePtr) node->children);