archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 05:58:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'PHP-7.4'

Browse source 
* PHP-7.4:
  Fixed bug #79029 (Use After Free's in XMLReader / XMLWriter).
This commit is contained in:
Xinchen Hui 2019-12-25 16:29:30 +08:00
commit ce4d80a85a
3 changed files with 36 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

4
ext/libxml/libxml.c
View file

@ -327,6 +327,10 @@ static void *php_libxml_streams_IO_open_wrapper(const char *filename, const char
context = php_stream_context_from_zval(Z_ISUNDEF(LIBXML(stream_context))? NULL : &LIBXML(stream_context), 0);
ret_val = php_stream_open_wrapper_ex(path_to_open, (char *)mode, REPORT_ERRORS, NULL, context);
if (ret_val) {
/* Prevent from closing this by fclose() */
((php_stream*)ret_val)->flags |= PHP_STREAM_FLAG_NO_FCLOSE;
}
if (isescaped) {
xmlFree(resolved_path);
}

32
ext/xmlwriter/tests/bug79029.phpt Normal file
View file

@ -0,0 +1,32 @@
--TEST--
#79029 (Use After Free's in XMLReader / XMLWriter)
--SKIPIF--
<?php if (!extension_loaded("xmlwriter")) print "skip"; ?>
--FILE--
<?php
$x = array( new XMLWriter() );
$x[0]->openUri("bug79029.txt");
$x[0]->startComment();
@unlink("bug79029.txt");
$x = new XMLWriter();
$x->openUri("bug79029.txt");
fclose(@end(get_resources()));
@unlink("bug79029.txt");
file_put_contents("bug79029.txt", "a");
$x = new XMLReader();
$x->open("bug79029.txt");
fclose(@end(get_resources()));
@unlink("bug79029.txt");
?>
okey
--CLEAN--
<?php
@unlink("bug79029.txt");
?>
--EXPECTF--
Warning: fclose(): %d is not a valid stream resource in %sbug79029.php on line %d
Warning: fclose(): %d is not a valid stream resource in %sbug79029.php on line %d
okey

13
ext/xmlwriter/tests/bug79029_1.phpt
View file

@ -1,13 +0,0 @@
--TEST--
#79029 (Use After Free's in XMLReader / XMLWriter)
--SKIPIF--
<?php if (!extension_loaded("xmlwriter")) print "skip"; ?>
--FILE--
<?php
$x = array( new XMLWriter() );
$x[0]->openUri("a");
$x[0]->startComment();
?>
okey
--EXPECT--
okey