mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-27 20:03:40 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.3'

Browse Source 
* PHP-8.3:
  Fix UAF when removing doctype and using foreach iteration
This commit is contained in:
Niels Dossche 2024-07-30 20:04:48 +02:00
commit ceca599649
No known key found for this signature in database
GPG Key ID: A17A7C526FE17078
4 changed files with 30 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ext/dom/dom_iterators.c
View File

@ -149,7 +149,7 @@ static xmlNodePtr dom_fetch_first_iteration_item(dom_nnodemap_object *objmap)
if (objmap->nodetype == XML_ATTRIBUTE_NODE) {
return (xmlNodePtr) basep->properties;
} else {
return basep->children;
return dom_nodelist_iter_start_first_child(basep);
}
} else {
int curindex = 0;

2
ext/dom/nodelist.c
View File

@ -50,7 +50,7 @@ static zend_always_inline void reset_objmap_cache(dom_nnodemap_object *objmap)
objmap->cached_length = -1;
}
static xmlNodePtr dom_nodelist_iter_start_first_child(xmlNodePtr nodep)
xmlNodePtr dom_nodelist_iter_start_first_child(xmlNodePtr nodep)
{
if (nodep->type == XML_ENTITY_REF_NODE) {
/* See entityreference.c */

4
ext/dom/php_dom.h
View File

@ -180,6 +180,7 @@ void dom_mark_namespaces_as_attributes_too(php_dom_libxml_ns_mapper *ns_mapper,
bool dom_compare_value(const xmlAttr *attr, const xmlChar *value);
void dom_attr_value_will_change(dom_object *obj, xmlAttrPtr attrp);
bool php_dom_create_nullable_object(xmlNodePtr obj, zval *return_value, dom_object *domobj);
xmlNodePtr dom_clone_node(php_dom_libxml_ns_mapper *ns_mapper, xmlNodePtr node, xmlDocPtr doc, bool recursive);
typedef enum {
DOM_LOAD_STRING = 0,
@ -215,8 +216,7 @@ void php_dom_named_node_map_get_named_item_into_zval(dom_nnodemap_object *objmap
xmlNodePtr php_dom_named_node_map_get_item(dom_nnodemap_object *objmap, zend_long index);
void php_dom_named_node_map_get_item_into_zval(dom_nnodemap_object *objmap, zend_long index, zval *return_value);
int php_dom_get_namednodemap_length(dom_object *obj);
xmlNodePtr dom_clone_node(php_dom_libxml_ns_mapper *ns_mapper, xmlNodePtr node, xmlDocPtr doc, bool recursive);
xmlNodePtr dom_nodelist_iter_start_first_child(xmlNodePtr nodep);
#define DOM_GET_INTERN(__id, __intern) { \
__intern = Z_DOMOBJ_P(__id); \

26
ext/dom/tests/uaf_doctype_iterator.phpt Normal file
View File

@ -0,0 +1,26 @@
--TEST--
UAF when removing doctype and iterating over the child nodes
--EXTENSIONS--
dom
--CREDITS--
Yuancheng Jiang
--FILE--
<?php
$dom = new DOMDocument;
$dom->loadXML(<<<XML
<!DOCTYPE foo [
<!ENTITY foo1 "bar1">
]>
<foo>&foo1;</foo>
XML);
$ref = $dom->documentElement->firstChild;
$nodes = $ref->childNodes;
$dom->removeChild($dom->doctype);
foreach($nodes as $str) {}
var_dump($nodes);
?>
--EXPECTF--
object(DOMNodeList)#%d (1) {
["length"]=>
int(0)
}