archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-20 09:24:05 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fix bug #71540 - NULL pointer dereference in xsl_ext_function_php()

Browse source
This commit is contained in:
Stanislav Malyshev 2016-02-14 23:35:29 -08:00
parent e18910c296
commit 889e3b62f4
2 changed files with 71 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

67
ext/xsl/tests/bug71540.phpt Normal file
View file

@ -0,0 +1,67 @@
--TEST--
Bug #71540 (NULL pointer dereference in xsl_ext_function_php())
--SKIPIF--
<?php
if (!extension_loaded('xsl')) die("skip Extension XSL is required\n");
?>
--FILE--
<?php
$xml = <<<EOB
<allusers>
<user>
<uid>bob</uid>
</user>
</allusers>
EOB;
$xsl = <<<EOB
<?xml version="1.0" encoding="UTF-8"?>
<xsl:stylesheet version="1.0"
xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
xmlns:php="http://php.net/xsl">
<xsl:output method="html" encoding="utf-8" indent="yes"/>
<xsl:template match="allusers">
<html><body>
<h2>Users</h2>
<table>
<xsl:for-each select="user">
<tr><td>
<xsl:value-of
select="php:function('test',uid,test(test))"/>
</td></tr>
</xsl:for-each>
</table>
</body></html>
</xsl:template>
</xsl:stylesheet>
EOB;
$xmldoc = new DOMDocument();
$xmldoc->loadXML($xml);
$xsldoc = new DOMDocument();
$xsldoc->loadXML($xsl);
$proc = new XSLTProcessor();
$proc->registerPHPFunctions();
$proc->importStyleSheet($xsldoc);
echo $proc->transformToXML($xmldoc);
?>
DONE
--EXPECTF--
Warning: XSLTProcessor::transformToXml(): xmlXPathCompOpEval: function test not found in %sbug71540.php on line %d
Warning: XSLTProcessor::transformToXml(): Unregistered function in %sbug71540.php on line %d
Warning: XSLTProcessor::transformToXml(): Stack usage errror in %sbug71540.php on line %d
Warning: XSLTProcessor::transformToXml(): Stack usage errror in %sbug71540.php on line %d
Warning: XSLTProcessor::transformToXml(): xmlXPathCompiledEval: 2 objects left on the stack. in %sbug71540.php on line %d
Warning: XSLTProcessor::transformToXml(): runtime error: file %s line 13 element value-of in %sbug71540.php on line %d
Warning: XSLTProcessor::transformToXml(): XPath evaluation returned no result. in %sbug71540.php on line %d
<html xmlns:php="http://php.net/xsl"><body>
<h2>Users</h2>
<table><tr><td></td></tr></table>
</body></html>
DONE

4
ext/xsl/xsltprocessor.c
View file

@ -231,6 +231,10 @@ static void xsl_ext_function_php(xmlXPathParserContextPtr ctxt, int nargs, int t
/* Reverse order to pop values off ctxt stack */ /* Reverse order to pop values off ctxt stack */
for (i = nargs - 2; i >= 0; i--) { for (i = nargs - 2; i >= 0; i--) {
obj = valuePop(ctxt); obj = valuePop(ctxt);
if (obj == NULL) {
ZVAL_NULL(&args[i]);
continue;
}
switch (obj->type) { switch (obj->type) {
case XPATH_STRING: case XPATH_STRING:
ZVAL_STRING(&args[i], (char *)obj->stringval); ZVAL_STRING(&args[i], (char *)obj->stringval);