mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-28 20:34:29 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix bug #46699: (xml_parse crash when parser is namespace aware)

Browse Source 
fix a couple warnings
add test
This commit is contained in:
Rob Richards 2008-12-12 04:15:14 +00:00
parent 20909366f9
commit 03e656bc05
2 changed files with 107 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

77
ext/xml/compat.c
View File

@ -40,7 +40,7 @@ _qualify_namespace(XML_Parser parser, const xmlChar *name, const xmlChar *URI, x
/* Use libxml functions otherwise its memory deallocation is screwed up */
*qualified = xmlStrdup(URI);
*qualified = xmlStrncat(*qualified, parser->_ns_seperator, 1);
*qualified = xmlStrncat(*qualified, name, strlen(name));
*qualified = xmlStrncat(*qualified, name, xmlStrlen(name));
} else {
*qualified = xmlStrdup(name);
}
@ -104,7 +104,66 @@ _start_element_handler_ns(void *user, const xmlChar *name, const xmlChar *prefix
y = 0;
}
if (parser->h_start_element == NULL && parser->h_default == NULL) {
if (parser->h_start_element == NULL) {
if (parser->h_default) {
if (prefix) {
qualified_name = xmlStrncatNew((xmlChar *)"<", prefix, xmlStrlen(prefix));
qualified_name = xmlStrncat(qualified_name, (xmlChar *)":", 1);
qualified_name = xmlStrncat(qualified_name, name, xmlStrlen(name));
} else {
qualified_name = xmlStrncatNew((xmlChar *)"<", name, xmlStrlen(name));
}
if (namespaces) {
int i, j;
for (i = 0,j = 0;j < nb_namespaces;j++) {
int ns_len;
char *ns_string, *ns_prefix, *ns_url;
ns_prefix = (char *) namespaces[i++];
ns_url = (char *) namespaces[i++];
if (ns_prefix) {
ns_len = spprintf(&ns_string, 0, " xmlns:%s=\"%s\"", ns_prefix, ns_url);
} else {
ns_len = spprintf(&ns_string, 0, " xmlns=\"%s\"", ns_url);
}
qualified_name = xmlStrncat(qualified_name, (xmlChar *)ns_string, ns_len);
efree(ns_string);
}
}
if (attributes) {
for (i = 0; i < nb_attributes; i += 1) {
int att_len;
char *att_string, *att_name, *att_value, *att_prefix, *att_valueend;
att_name = (char *) attributes[y++];
att_prefix = (char *)attributes[y++];
y++;
att_value = (char *)attributes[y++];
att_valueend = (char *)attributes[y++];
if (att_prefix) {
att_len = spprintf(&att_string, 0, " %s:%s=\"", att_prefix, att_name);
} else {
att_len = spprintf(&att_string, 0, " %s=\"", att_name);
}
qualified_name = xmlStrncat(qualified_name, (xmlChar *)att_string, att_len);
qualified_name = xmlStrncat(qualified_name, (xmlChar *)att_value, att_valueend - att_value);
qualified_name = xmlStrncat(qualified_name, (xmlChar *)"\"", 1);
efree(att_string);
}
}
qualified_name = xmlStrncat(qualified_name, (xmlChar *)">", 1);
parser->h_default(parser->user, (const XML_Char *) qualified_name, xmlStrlen(qualified_name));
xmlFree(qualified_name);
}
return;
}
_qualify_namespace(parser, name, URI, &qualified_name);
@ -178,6 +237,18 @@ _end_element_handler_ns(void *user, const xmlChar *name, const xmlChar * prefix,
XML_Parser parser = (XML_Parser) user;
if (parser->h_end_element == NULL) {
if (parser->h_default) {
char *end_element;
int end_element_len;
if (prefix) {
end_element_len = spprintf(&end_element, 0, "</%s:%s>", (char *) prefix, (char *)name);
} else {
end_element_len = spprintf(&end_element, 0, "</%s>", (char *)name);
}
parser->h_default(parser->user, (const XML_Char *) end_element, end_element_len);
efree(end_element);
}
return;
}
@ -212,7 +283,7 @@ _pi_handler(void *user, const xmlChar *target, const xmlChar *data)
if (parser->h_default) {
char *full_pi;
spprintf(&full_pi, 0, "<?%s %s?>", (char *)target, (char *)data);
parser->h_default(parser->user, (const XML_Char *) full_pi, xmlStrlen(full_pi));
parser->h_default(parser->user, (const XML_Char *) full_pi, strlen(full_pi));
efree(full_pi);
}
return;

33
ext/xml/tests/bug46699.phpt Normal file
View File

@ -0,0 +1,33 @@
--TEST--
Bug #46699: (xml_parse crash when parser is namespace aware)
--SKIPIF--
<?php
require_once("skipif.inc");
if (! @xml_parser_create_ns('ISO-8859-1')) { die("skip xml_parser_create_ns is not supported on this platform");}
?>
--FILE--
<?php
function defaultfunc($parser, $data)
{
echo $data;
}
$xml = <<<HERE
<a xmlns="http://example.com/foo"
xmlns:bar="http://example.com/bar">
<bar:b foo="bar">1</bar:b>
<bar:c bar:nix="null" foo="bar">2</bar:c>
</a>
HERE;
$parser = xml_parser_create_ns("ISO-8859-1","@");
xml_set_default_handler($parser,'defaultfunc');
xml_parser_set_option($parser,XML_OPTION_CASE_FOLDING,0);
xml_parse($parser, $xml);
xml_parser_free($parser);
?>
--EXPECT--
<a xmlns="http://example.com/foo" xmlns:bar="http://example.com/bar">
<bar:b foo="bar">1</bar:b>
<bar:c bar:nix="null" foo="bar">2</bar:c>
</a>