archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'PHP-8.3'

Browse source 
* PHP-8.3:
  Revert "Fix crashes with entity references and predefined entities"
This commit is contained in:
Niels Dossche 2023-12-23 17:31:28 +01:00
commit 76f24d3531
3 changed files with 8 additions and 77 deletions
Download patch file Download diff file Expand all files Collapse all files

46
ext/dom/tests/DOMEntityReference_predefined_free.phpt
View file

@ -1,46 +0,0 @@
--TEST--
Freeing of a predefined DOMEntityReference
--EXTENSIONS--
dom
--FILE--
<?php
$ref = new DOMEntityReference("amp");
var_dump($ref);
?>
--EXPECT--
object(DOMEntityReference)#1 (17) {
["nodeName"]=>
string(3) "amp"
["nodeValue"]=>
NULL
["nodeType"]=>
int(5)
["parentNode"]=>
NULL
["parentElement"]=>
NULL
["childNodes"]=>
string(22) "(object value omitted)"
["firstChild"]=>
string(22) "(object value omitted)"
["lastChild"]=>
string(22) "(object value omitted)"
["previousSibling"]=>
NULL
["nextSibling"]=>
NULL
["attributes"]=>
NULL
["isConnected"]=>
bool(false)
["namespaceURI"]=>
NULL
["prefix"]=>
string(0) ""
["localName"]=>
NULL
["baseURI"]=>
NULL
["textContent"]=>
string(0) ""
}

22
ext/dom/tests/delayed_freeing/entity_declaration.phpt
View file

@ -9,32 +9,16 @@ $doc->loadXML(<<<'XML'
<?xml version="1.0"?>
<!DOCTYPE books [
<!ENTITY test "entity is only for test purposes">
<!ENTITY myimage PUBLIC "-" "mypicture.gif" NDATA GIF>
]>
<container/>
XML);
$ref1 = $doc->createEntityReference("test");
$ref2 = $doc->createEntityReference("myimage");
$entity1 = $doc->doctype->entities[0];
$entity2 = $doc->doctype->entities[1];
// Entity order depends on addresses
if ($entity1->nodeName !== "test") {
[$entity1, $entity2] = [$entity2, $entity1];
}
var_dump($entity1->nodeName, $entity1->parentNode->nodeName);
var_dump($entity2->nodeName, $entity2->parentNode->nodeName);
$entity = $doc->doctype->entities[0];
var_dump($entity->nodeName, $entity->parentNode->nodeName);
$doc->removeChild($doc->doctype);
var_dump($entity1->nodeName, $entity1->parentNode);
var_dump($entity2->nodeName, $entity2->parentNode);
var_dump($entity->nodeName, $entity->parentNode);
?>
--EXPECT--
string(4) "test"
string(5) "books"
string(7) "myimage"
string(5) "books"
string(4) "test"
NULL
string(7) "myimage"
NULL

17
ext/libxml/libxml.c
View file

@ -208,10 +208,12 @@ static void php_libxml_node_free(xmlNodePtr node)
* dtd is attached to the document. This works around the issue by inspecting the parent directly. */
case XML_ENTITY_DECL: {
xmlEntityPtr entity = (xmlEntityPtr) node;
if (entity->etype != XML_INTERNAL_PREDEFINED_ENTITY) {
php_libxml_unlink_entity_decl(entity);
xmlFreeEntity(entity);
php_libxml_unlink_entity_decl(entity);
if (entity->orig != NULL) {
xmlFree((char *) entity->orig);
entity->orig = NULL;
}
xmlFreeNode(node);
break;
}
case XML_NOTATION_NODE: {
@ -1382,15 +1384,6 @@ PHP_LIBXML_API void php_libxml_node_free_resource(xmlNodePtr node)
case XML_DOCUMENT_NODE:
case XML_HTML_DOCUMENT_NODE:
break;
case XML_ENTITY_REF_NODE:
/* Entity reference nodes are special: their children point to entity declarations,
* but they don't own the declarations and therefore shouldn't free the children.
* Moreover, there can be N>1 reference nodes for a single entity declarations. */
php_libxml_unregister_node(node);
if (node->parent == NULL) {
php_libxml_node_free(node);
}
break;
default:
if (node->parent == NULL || node->type == XML_NAMESPACE_DECL) {
php_libxml_node_free_list((xmlNodePtr) node->children);