archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 13:38:49 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix GH-18979: DOM\XMLDocument::createComment() triggers undefined behavior with null byte

Browse source 
Closes GH-18983.
This commit is contained in:
Niels Dossche 2025-06-30 18:48:27 +02:00
parent 7f5d491a05
commit 1d5089e574
No known key found for this signature in database
GPG key ID: B8A8AD166DF0E2E5
3 changed files with 22 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
NEWS
View file

@ -14,6 +14,10 @@ PHP NEWS
. Fix memory leaks when returning refcounted value from curl callback.
(nielsdos)
- DOM:
. Fixed bug GH-18979 (Dom\XMLDocument::createComment() triggers undefined
behavior with null byte). (nielsdos)
- LDAP:
. Fixed GH-18902 ldap_exop/ldap_exop_sync assert triggered on empty
request OID. (David Carlier)

13
ext/dom/tests/modern/xml/gh18979.phpt Normal file
View file

@ -0,0 +1,13 @@
--TEST--
GH-18979 (DOM\XMLDocument::createComment() triggers undefined behavior with null byte)
--EXTENSIONS--
dom
--FILE--
<?php
$dom = Dom\XMLDocument::createEmpty();
$container = $dom->createElement("container");
$container->append($dom->createComment("\0"));
var_dump($container->innerHTML);
?>
--EXPECT--
string(7) "<!---->"

6
ext/dom/xml_serializer.c
View file

@ -640,7 +640,11 @@ static int dom_xml_serialize_comment_node(xmlOutputBufferPtr out, xmlNodePtr com
const xmlChar *ptr = comment->content;
if (ptr != NULL) {
TRY(dom_xml_check_char_production(ptr));
if (strstr((const char *) ptr, "--") != NULL || ptr[strlen((const char *) ptr) - 1] == '-') {
if (strstr((const char *) ptr, "--") != NULL) {
return -1;
}
size_t len = strlen((const char *) ptr);
if (len > 0 && ptr[len - 1] == '-') {
return -1;
}
}