Bug #78025 [Ver->Csd]: segfault when accessing properties of DOMDocumentType

Edit report at https://bugs.php.net/bug.php?id=78025&edit=1 ID: 78025 Updated by: cmb@php.net Reported by: ph dot fritsche at gmail dot com Summary: segfault when accessing properties of DOMDocumentType -Status: Verified +Status: Closed Type: Bug Package: DOM XML related Operating System: Windows PHP Version: 7.2.18 Assigned To: cmb Block user comment: N Private report: N New Comment: Automatic comment on behalf of cmbecker69@gmx.de Revision: http://git.php.net/?p=php-src.git;a=commit;h=e246dea9fe4d679f20de298c753d9ad083dbad68 Log: Fix #78025: segfault when accessing properties of DOMDocumentType Previous Comments: ------------------------------------------------------------------------ [2019-05-17 10:26:55] ph dot fritsche at gmail dot com A warning is already issued by loadHTML() reporting the malformed declaration. Just returning the empty string should be fine. ------------------------------------------------------------------------ [2019-05-17 09:57:01] cmb@php.net The fix could be as simple as ext/dom/documenttype.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ext/dom/documenttype.c b/ext/dom/documenttype.c index ff7107d165..dd8a647167 100644 --- a/ext/dom/documenttype.c +++ b/ext/dom/documenttype.c @@ -50,7 +50,7 @@ int dom_documenttype_name_read(dom_object *obj, zval *retval) return FAILURE; } - ZVAL_STRING(retval, (char *) (dtdptr->name)); + ZVAL_STRING(retval, dtdptr->name ? (char *) (dtdptr->name) : ""); return SUCCESS; } The question is which property value should be reported, and whether there should be an additional notice/warning. ------------------------------------------------------------------------ [2019-05-17 09:04:49] sjon@php.net I can confirm - see https://3v4l.org/LE4P6. Happens on all of the supported versions (on linux as well) ------------------------------------------------------------------------ [2019-05-17 09:01:14] ph dot fritsche at gmail dot com Description: ------------ PHP crashes when accessing properties of DOMDocumentType after loading a malformed declaration. code: c0000005 offset: 00000000002985c3 Test script: --------------- <?php $htm = "<!DOCTYPE><html></html>"; $dom = new DOMDocument; $dom->loadHTML($htm); $dom->doctype; var_dump("i'm still here"); $dom->doctype->name; var_dump("i'm not"); ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=78025&edit=1