archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 13:38:49 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'PHP-8.4'

Browse source 
* PHP-8.4:
  Fix GH-19098: libxml<2.13 segmentation fault caused by php_libxml_node_free
This commit is contained in:
Niels Dossche 2025-07-20 17:20:53 +02:00
commit 541620cf78
No known key found for this signature in database
GPG key ID: B8A8AD166DF0E2E5
2 changed files with 64 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

21
ext/libxml/libxml.c
View file

@ -342,7 +342,26 @@ PHP_LIBXML_API void php_libxml_node_free_list(xmlNodePtr node)
if (ptr->_private) {
const php_libxml_node_object *obj = ptr->_private;
if (!obj->document || obj->document->class_type < PHP_LIBXML_CLASS_MODERN) {
xmlReconciliateNs(curnode->doc, curnode);
if (LIBXML_VERSION < 21300 && UNEXPECTED(curnode->doc == NULL)) {
/* xmlReconciliateNs() in these versions just uses the document for xmlNewReconciledNs(),
* which can create an oldNs xml namespace declaration via xmlSearchNs() -> xmlTreeEnsureXMLDecl(). */
xmlDoc dummy;
memset(&dummy, 0, sizeof(dummy));
dummy.type = XML_DOCUMENT_NODE;
curnode->doc = &dummy;
xmlReconciliateNs(curnode->doc, curnode);
curnode->doc = NULL;
/* Append oldNs to current node's nsDef, which can be at most one node. */
if (dummy.oldNs) {
ZEND_ASSERT(dummy.oldNs->next == NULL);
xmlNsPtr old = curnode->nsDef;
curnode->nsDef = dummy.oldNs;
dummy.oldNs->next = old;
}
} else {
xmlReconciliateNs(curnode->doc, curnode);
}
}
}
}

44
ext/xmlreader/tests/gh19098.phpt Normal file
View file

@ -0,0 +1,44 @@
--TEST--
GH-19098 (libxml<2.13 segmentation fault caused by php_libxml_node_free)
--EXTENSIONS--
xmlreader
dom
--FILE--
<?php
$xml_reader = \XMLReader::XML('
<sparql xmlns="http://www.w3.org/2005/sparql-results#">
<results>
<result><binding xml:id="foo" xmlns:custom="urn:custom" custom:foo="bar" name="s"><uri/></binding></result>
</results>
</sparql>');
$success = $xml_reader->next("sparql");
$success = $xml_reader->read();
$success = $xml_reader->next("results");
while ($xml_reader->read()) {
if ($xml_reader->next("result")) {
$result_as_dom_node = $xml_reader->expand();
$child = $result_as_dom_node->firstChild;
unset($result_as_dom_node);
var_dump($child->namespaceURI);
foreach ($child->attributes as $attr) {
var_dump($attr->namespaceURI);
}
$doc = new DOMDocument;
$doc->adoptNode($child);
echo $doc->saveXML($child), "\n";
unset($child);
break;
}
}
?>
--EXPECT--
string(38) "http://www.w3.org/2005/sparql-results#"
string(36) "http://www.w3.org/XML/1998/namespace"
string(10) "urn:custom"
NULL
<default:binding xmlns:custom="urn:custom" xmlns:default="http://www.w3.org/2005/sparql-results#" xml:id="foo" custom:foo="bar" name="s"><default:uri/></default:binding>