com php-src: add range checks to simplexml: ext/simplexml/simplexml.c

Commit: 2c523f21c9781f334cd2ef3c494a08b7bea1d8f5 Author: Anatol Belski <ab@php.net> Tue, 25 Aug 2015 17:37:35 +0200 Parents: d40a149ade589cdb97604ceb22560214ff3870bd Branches: master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=2c523f21c9781f334cd2ef3c494a08b7bea1d8f5 Log: add range checks to simplexml Changed paths: M ext/simplexml/simplexml.c Diff: diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c index d7da100..78b9829 100644 --- a/ext/simplexml/simplexml.c +++ b/ext/simplexml/simplexml.c @@ -2203,7 +2203,12 @@ PHP_FUNCTION(simplexml_load_file) return; } - docp = xmlReadFile(filename, NULL, options); + if (ZEND_LONG_EXCEEDS_INT(options)) { + php_error_docref(NULL, E_WARNING, "Invalid options"); + RETURN_FALSE; + } + + docp = xmlReadFile(filename, NULL, (int)options); if (!docp) { RETURN_FALSE; @@ -2244,7 +2249,20 @@ PHP_FUNCTION(simplexml_load_string) return; } - docp = xmlReadMemory(data, data_len, NULL, NULL, options); + if (ZEND_SIZE_T_INT_OVFL(data_len)) { + php_error_docref(NULL, E_WARNING, "Data is too long"); + RETURN_FALSE; + } + if (ZEND_SIZE_T_INT_OVFL(ns_len)) { + php_error_docref(NULL, E_WARNING, "Namespace is too long"); + RETURN_FALSE; + } + if (ZEND_LONG_EXCEEDS_INT(options)) { + php_error_docref(NULL, E_WARNING, "Invalid options"); + RETURN_FALSE; + } + + docp = xmlReadMemory(data, (int)data_len, NULL, NULL, (int)options); if (!docp) { RETURN_FALSE; @@ -2281,7 +2299,20 @@ SXE_METHOD(__construct) return; } - docp = is_url ? xmlReadFile(data, NULL, options) : xmlReadMemory(data, data_len, NULL, NULL, options); + if (ZEND_SIZE_T_INT_OVFL(data_len)) { + php_error_docref(NULL, E_WARNING, "Data is too long"); + RETURN_FALSE; + } + if (ZEND_SIZE_T_INT_OVFL(ns_len)) { + php_error_docref(NULL, E_WARNING, "Namespace is too long"); + RETURN_FALSE; + } + if (ZEND_LONG_EXCEEDS_INT(options)) { + php_error_docref(NULL, E_WARNING, "Invalid options"); + RETURN_FALSE; + } + + docp = is_url ? xmlReadFile(data, NULL, (int)options) : xmlReadMemory(data, (int)data_len, NULL, NULL, (int)options); if (!docp) { ((php_libxml_node_object *)sxe)->document = NULL;