mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-28 04:14:26 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-7.0' into PHP-7.1

Browse Source
This commit is contained in:
Christoph M. Becker 2016-08-20 02:16:39 +02:00
commit 76c796fb27
3 changed files with 51 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
NEWS
View File

@ -5,6 +5,8 @@ PHP NEWS
- IMAP:
. Fixed bug #72852 (imap_mail null dereference). (Anatol)
- XML:
. Fixed bug #72714 (_xml_startElementHandler() segmentation fault). (cmb)
18 Aug 2016, PHP 7.1.0beta3

35
ext/xml/tests/bug72714.phpt Normal file
View File

@ -0,0 +1,35 @@
--TEST--
Bug #72714 (_xml_startElementHandler() segmentation fault)
--SKIPIF--
<?php
if (!extension_loaded('xml')) die('skip xml extension not available');
?>
--FILE--
<?php
function startElement($parser, $name, $attribs) {
var_dump($name);
}
function endElement($parser, $name) {}
function parse($tagstart) {
$xml = '<ns1:total>867</ns1:total>';
$xml_parser = xml_parser_create();
xml_set_element_handler($xml_parser, 'startElement', 'endElement');
xml_parser_set_option($xml_parser, XML_OPTION_SKIP_TAGSTART, $tagstart);
xml_parse($xml_parser, $xml);
xml_parser_free($xml_parser);
}
parse(3015809298423721);
parse(20);
?>
===DONE===
--EXPECTF--
Notice: xml_parser_set_option(): tagstart ignored in %s%ebug72714.php on line %d
string(9) "NS1:TOTAL"
string(0) ""
===DONE===

20
ext/xml/xml.c
View File

@ -69,6 +69,10 @@ ZEND_GET_MODULE(xml)
#endif /* COMPILE_DL_XML */
/* }}} */
#define SKIP_TAGSTART(str) ((str) + (parser->toffset > strlen(str) ? strlen(str) : + parser->toffset))
/* {{{ function prototypes */
PHP_MINIT_FUNCTION(xml);
PHP_MINFO_FUNCTION(xml);
@ -727,7 +731,7 @@ void _xml_startElementHandler(void *userData, const XML_Char *name, const XML_Ch
if (!Z_ISUNDEF(parser->startElementHandler)) {
ZVAL_COPY(&args[0], &parser->index);
ZVAL_STRING(&args[1], ZSTR_VAL(tag_name) + parser->toffset);
ZVAL_STRING(&args[1], SKIP_TAGSTART(ZSTR_VAL(tag_name)));
array_init(&args[2]);
while (attributes && *attributes) {
@ -758,7 +762,7 @@ void _xml_startElementHandler(void *userData, const XML_Char *name, const XML_Ch
_xml_add_to_info(parser, ZSTR_VAL(tag_name) + parser->toffset);
add_assoc_string(&tag, "tag", ZSTR_VAL(tag_name) + parser->toffset); /* cast to avoid gcc-warning */
add_assoc_string(&tag, "tag", SKIP_TAGSTART(ZSTR_VAL(tag_name))); /* cast to avoid gcc-warning */
add_assoc_string(&tag, "type", "open");
add_assoc_long(&tag, "level", parser->level);
@ -812,7 +816,7 @@ void _xml_endElementHandler(void *userData, const XML_Char *name)
if (!Z_ISUNDEF(parser->endElementHandler)) {
ZVAL_COPY(&args[0], &parser->index);
ZVAL_STRING(&args[1], ZSTR_VAL(tag_name) + parser->toffset);
ZVAL_STRING(&args[1], SKIP_TAGSTART(ZSTR_VAL(tag_name)));
xml_call_handler(parser, &parser->endElementHandler, parser->endElementPtr, 2, args, &retval);
zval_ptr_dtor(&retval);
@ -828,7 +832,7 @@ void _xml_endElementHandler(void *userData, const XML_Char *name)
_xml_add_to_info(parser, ZSTR_VAL(tag_name) + parser->toffset);
add_assoc_string(&tag, "tag", ZSTR_VAL(tag_name) + parser->toffset); /* cast to avoid gcc-warning */
add_assoc_string(&tag, "tag", SKIP_TAGSTART(ZSTR_VAL(tag_name))); /* cast to avoid gcc-warning */
add_assoc_string(&tag, "type", "close");
add_assoc_long(&tag, "level", parser->level);
@ -922,9 +926,9 @@ void _xml_characterDataHandler(void *userData, const XML_Char *s, int len)
if (parser->level <= XML_MAXLEVEL && parser->level > 0) {
array_init(&tag);
_xml_add_to_info(parser,parser->ltags[parser->level-1] + parser->toffset);
_xml_add_to_info(parser,SKIP_TAGSTART(parser->ltags[parser->level-1]));
add_assoc_string(&tag, "tag", parser->ltags[parser->level-1] + parser->toffset);
add_assoc_string(&tag, "tag", SKIP_TAGSTART(parser->ltags[parser->level-1]));
add_assoc_str(&tag, "value", decoded_value);
add_assoc_string(&tag, "type", "cdata");
add_assoc_long(&tag, "level", parser->level);
@ -1601,6 +1605,10 @@ PHP_FUNCTION(xml_parser_set_option)
case PHP_XML_OPTION_SKIP_TAGSTART:
convert_to_long_ex(val);
parser->toffset = Z_LVAL_P(val);
if (parser->toffset < 0) {
php_error_docref(NULL TSRMLS_CC, E_NOTICE, "tagstart ignored");
parser->toffset = 0;
}
break;
case PHP_XML_OPTION_SKIP_WHITE:
convert_to_long_ex(val);