archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix GH-17153: SimpleXML crash when using autovivification on document

Browse source 
In the case of a member string, `mynode` may also be a document, which
doesn't have a namespace.

Closes GH-17156.
This commit is contained in:
Niels Dossche 2024-12-14 12:10:20 +01:00
parent 388f63c310
commit a57a434f95
No known key found for this signature in database
GPG key ID: B8A8AD166DF0E2E5
3 changed files with 51 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
NEWS
View file

@ -27,6 +27,8 @@ PHP NEWS
- SimpleXML:
. Fixed bug GH-17040 (SimpleXML's unset can break DOM objects). (nielsdos)
. Fixed bug GH-17153 (SimpleXML crash when using autovivification on
document). (nielsdos)
- Sockets:
. Fixed bug GH-16276 (socket_strerror overflow handling with INT_MIN).

5
ext/simplexml/simplexml.c
View file

@ -576,7 +576,10 @@ next_iter:
if (!member || Z_TYPE_P(member) == IS_LONG) {
newnode = xmlNewTextChild(mynode->parent, mynode->ns, mynode->name, value_str ? (xmlChar *)ZSTR_VAL(value_str) : NULL);
} else {
newnode = xmlNewTextChild(mynode, mynode->ns, (xmlChar *)Z_STRVAL_P(member), value_str ? (xmlChar *)ZSTR_VAL(value_str) : NULL);
/* Note: we cannot set the namespace here unconditionally because the parent may be a document.
* Passing NULL will let libxml decide to either inherit the namespace or not set one at all,
* depending on whether the parent is an element. */
newnode = xmlNewTextChild(mynode, NULL, (xmlChar *)Z_STRVAL_P(member), value_str ? (xmlChar *)ZSTR_VAL(value_str) : NULL);
}
} else if (!member || Z_TYPE_P(member) == IS_LONG) {
if (member && cnt < Z_LVAL_P(member)) {

45
ext/simplexml/tests/gh17153.phpt Normal file
View file

@ -0,0 +1,45 @@
--TEST--
GH-17153 (SimpleXML crash when using autovivification on document)
--EXTENSIONS--
dom
simplexml
xsl
--FILE--
<?php
$sxe = simplexml_load_file(__DIR__ . '/../../xsl/tests/53965/collection.xml', SimpleXMLElement::class);
$processor = new XSLTProcessor;
$dom = new DOMDocument;
$dom->load(__DIR__ . '/../../xsl/tests/53965/collection.xsl');
$processor->importStylesheet($dom);
$result = $processor->transformToDoc($sxe, SimpleXMLElement::class);
$result->h = "x";
var_dump($result);
?>
--EXPECT--
object(SimpleXMLElement)#4 (4) {
["h1"]=>
array(2) {
[0]=>
string(19) "Fight for your mind"
[1]=>
string(17) "Electric Ladyland"
}
["h2"]=>
array(2) {
[0]=>
string(20) "by Ben Harper - 1995"
[1]=>
string(22) "by Jimi Hendrix - 1997"
}
["hr"]=>
array(2) {
[0]=>
object(SimpleXMLElement)#5 (0) {
}
[1]=>
object(SimpleXMLElement)#6 (0) {
}
}
["h"]=>
string(1) "x"
}