archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Don't add 1 when calling xmlNodeSetContent()

Browse source 
The length is passed to xmlStrndup(), which also adds 1, and adds a null
terminator past the end. It worked because the length is not actually
stored. Strings in libxml2 are null terminated. Passing the length just
avoids a call to strlen().
This commit is contained in:
Tim Starling 2022-12-22 11:43:20 +11:00 • committed by nielsdos
parent 74910b1403
commit ee68c22128
3 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
ext/dom/characterdata.c
View file

@ -70,7 +70,7 @@ int dom_characterdata_data_write(dom_object *obj, zval *newval)
return FAILURE;
}
xmlNodeSetContentLen(nodep, (xmlChar *) ZSTR_VAL(str), ZSTR_LEN(str) + 1);
xmlNodeSetContentLen(nodep, (xmlChar *) ZSTR_VAL(str), ZSTR_LEN(str));
zend_string_release_ex(str, 0);
return SUCCESS;

2
ext/dom/node.c
View file

@ -185,7 +185,7 @@ int dom_node_node_value_write(dom_object *obj, zval *newval)
case XML_COMMENT_NODE:
case XML_CDATA_SECTION_NODE:
case XML_PI_NODE:
xmlNodeSetContentLen(nodep, (xmlChar *) ZSTR_VAL(str), ZSTR_LEN(str) + 1);
xmlNodeSetContentLen(nodep, (xmlChar *) ZSTR_VAL(str), ZSTR_LEN(str));
break;
default:
break;

2
ext/dom/processinginstruction.c
View file

@ -130,7 +130,7 @@ int dom_processinginstruction_data_write(dom_object *obj, zval *newval)
php_libxml_invalidate_node_list_cache_from_doc(nodep->doc);
xmlNodeSetContentLen(nodep, (xmlChar *) ZSTR_VAL(str), ZSTR_LEN(str) + 1);
xmlNodeSetContentLen(nodep, (xmlChar *) ZSTR_VAL(str), ZSTR_LEN(str));
zend_string_release_ex(str, 0);
return SUCCESS;