archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 05:58:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'PHP-8.3'

Browse source 
* PHP-8.3:
  Fix UAF when removing doctype and using foreach iteration
This commit is contained in:
Niels Dossche 2024-07-30 20:04:48 +02:00
commit ceca599649
No known key found for this signature in database
GPG key ID: A17A7C526FE17078
4 changed files with 30 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

2
ext/dom/dom_iterators.c
View file

@ -149,7 +149,7 @@ static xmlNodePtr dom_fetch_first_iteration_item(dom_nnodemap_object *objmap)
if (objmap->nodetype == XML_ATTRIBUTE_NODE) { if (objmap->nodetype == XML_ATTRIBUTE_NODE) {
return (xmlNodePtr) basep->properties; return (xmlNodePtr) basep->properties;
} else { } else {
return basep->children; return dom_nodelist_iter_start_first_child(basep);
} }
} else { } else {
int curindex = 0; int curindex = 0;

2
ext/dom/nodelist.c
View file

@ -50,7 +50,7 @@ static zend_always_inline void reset_objmap_cache(dom_nnodemap_object *objmap)
objmap->cached_length = -1; objmap->cached_length = -1;
} }
static xmlNodePtr dom_nodelist_iter_start_first_child(xmlNodePtr nodep) xmlNodePtr dom_nodelist_iter_start_first_child(xmlNodePtr nodep)
{ {
if (nodep->type == XML_ENTITY_REF_NODE) { if (nodep->type == XML_ENTITY_REF_NODE) {
/* See entityreference.c */ /* See entityreference.c */

4
ext/dom/php_dom.h
View file

@ -180,6 +180,7 @@ void dom_mark_namespaces_as_attributes_too(php_dom_libxml_ns_mapper *ns_mapper,
bool dom_compare_value(const xmlAttr *attr, const xmlChar *value); bool dom_compare_value(const xmlAttr *attr, const xmlChar *value);
void dom_attr_value_will_change(dom_object *obj, xmlAttrPtr attrp); void dom_attr_value_will_change(dom_object *obj, xmlAttrPtr attrp);
bool php_dom_create_nullable_object(xmlNodePtr obj, zval *return_value, dom_object *domobj); bool php_dom_create_nullable_object(xmlNodePtr obj, zval *return_value, dom_object *domobj);
xmlNodePtr dom_clone_node(php_dom_libxml_ns_mapper *ns_mapper, xmlNodePtr node, xmlDocPtr doc, bool recursive);
typedef enum { typedef enum {
DOM_LOAD_STRING = 0, DOM_LOAD_STRING = 0,
@ -215,8 +216,7 @@ void php_dom_named_node_map_get_named_item_into_zval(dom_nnodemap_object *objmap
xmlNodePtr php_dom_named_node_map_get_item(dom_nnodemap_object *objmap, zend_long index); xmlNodePtr php_dom_named_node_map_get_item(dom_nnodemap_object *objmap, zend_long index);
void php_dom_named_node_map_get_item_into_zval(dom_nnodemap_object *objmap, zend_long index, zval *return_value); void php_dom_named_node_map_get_item_into_zval(dom_nnodemap_object *objmap, zend_long index, zval *return_value);
int php_dom_get_namednodemap_length(dom_object *obj); int php_dom_get_namednodemap_length(dom_object *obj);
xmlNodePtr dom_nodelist_iter_start_first_child(xmlNodePtr nodep);
xmlNodePtr dom_clone_node(php_dom_libxml_ns_mapper *ns_mapper, xmlNodePtr node, xmlDocPtr doc, bool recursive);
#define DOM_GET_INTERN(__id, __intern) { \ #define DOM_GET_INTERN(__id, __intern) { \
__intern = Z_DOMOBJ_P(__id); \ __intern = Z_DOMOBJ_P(__id); \

26
ext/dom/tests/uaf_doctype_iterator.phpt Normal file
View file

@ -0,0 +1,26 @@
--TEST--
UAF when removing doctype and iterating over the child nodes
--EXTENSIONS--
dom
--CREDITS--
Yuancheng Jiang
--FILE--
<?php
$dom = new DOMDocument;
$dom->loadXML(<<<XML
<!DOCTYPE foo [
<!ENTITY foo1 "bar1">
]>
<foo>&foo1;</foo>
XML);
$ref = $dom->documentElement->firstChild;
$nodes = $ref->childNodes;
$dom->removeChild($dom->doctype);
foreach($nodes as $str) {}
var_dump($nodes);
?>
--EXPECTF--
object(DOMNodeList)#%d (1) {
["length"]=>
int(0)
}