archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix GH-15570: Segmentation fault (access null pointer) in ext/dom/html5_serializer.c

Browse source 
Closes GH-15572.
This commit is contained in:
Niels Dossche 2024-08-24 17:07:19 +02:00
parent 2ca4f31bc7
commit 690ce6d5d4
No known key found for this signature in database
GPG key ID: B8A8AD166DF0E2E5
3 changed files with 23 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
NEWS
View file

@ -24,6 +24,8 @@ PHP NEWS
- DOM:
. Fixed bug GH-15551 (Segmentation fault (access null pointer) in
ext/dom/xml_common.h). (nielsdos)
. Fixed bug GH-15570 (Segmentation fault (access null pointer) in
ext/dom/html5_serializer.c). (nielsdos)
- FPM:
. Added memory peak to the scoreboard / status page. (Flávio Heleno)

4
ext/dom/html5_serializer.c
View file

@ -137,8 +137,8 @@ static zend_result dom_html5_serialize_text_node(dom_html5_serialize_context *ct
return SUCCESS;
}
if (node->parent->type == XML_ELEMENT_NODE && php_dom_ns_is_fast(node->parent, php_dom_ns_is_html_magic_token)) {
const xmlNode *parent = node->parent;
const xmlNode *parent = node->parent;
if (parent != NULL && parent->type == XML_ELEMENT_NODE && php_dom_ns_is_fast(parent, php_dom_ns_is_html_magic_token)) {
size_t name_length = strlen((const char *) parent->name);
/* Spec tells us to only emit noscript content as-is if scripting is enabled.
* However, the user agent (PHP) does not support (JS) scripting.

19
ext/dom/tests/gh15570.phpt Normal file
View file

@ -0,0 +1,19 @@
--TEST--
GH-15570 (Segmentation fault (access null pointer) in ext/dom/html5_serializer.c)
--CREDITS--
YuanchengJiang
--EXTENSIONS--
dom
--FILE--
<?php
$html = <<<HTML
<head>
</html>
HTML;
$dom = Dom\HTMLDocument::createFromString($html, LIBXML_NOERROR);
$a = $dom->head->firstChild->cloneNode(false);
var_dump($dom->saveHTML($a));
?>
--EXPECT--
string(1) "
"