com php-src: Fixed bug #74950 (nullpointer deref in simplexml_element_getDocNamespaces): NEWS ext/simpl exml/simplexml.c
ext/simplexml/tests/bug74950.p hpt

Commit: 3a7b0027f32881710ff64278a4f98b7e052578d2 Author: Xinchen Hui <laruence@gmail.com> Fri, 21 Jul 2017 18:16:11 +0800 Parents: 95d2908814585bd9c3c9a1eab4989bc551b6cc73 Branches: PHP-7.0 PHP-7.1 PHP-7.2 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=3a7b0027f32881710ff64278a4f98b7e052578d2 Log: Fixed bug #74950 (nullpointer deref in simplexml_element_getDocNamespaces) Bugs: https://bugs.php.net/74950 Changed paths: M NEWS M ext/simplexml/simplexml.c A ext/simplexml/tests/bug74950.phpt Diff: diff --git a/NEWS b/NEWS index bc67ec9..f174c5c 100644 --- a/NEWS +++ b/NEWS @@ -5,6 +5,10 @@ PHP NEWS - Core: . Fixed bug #74947 (Segfault in scanner on INF number). (Laruence) +- SimpleXML: + . Fixed bug #74950 (nullpointer deref in simplexml_element_getDocNamespaces). + (Laruence) + - SPL: . Fixed bug #74669 (Unserialize ArrayIterator broken). (Andrew Nester) diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c index b8b5c37..0637e06 100644 --- a/ext/simplexml/simplexml.c +++ b/ext/simplexml/simplexml.c @@ -2321,16 +2321,16 @@ SXE_METHOD(__construct) } if (ZEND_SIZE_T_INT_OVFL(data_len)) { - php_error_docref(NULL, E_WARNING, "Data is too long"); - RETURN_FALSE; + zend_throw_exception(zend_ce_exception, "Data is too long", 0); + return; } if (ZEND_SIZE_T_INT_OVFL(ns_len)) { - php_error_docref(NULL, E_WARNING, "Namespace is too long"); - RETURN_FALSE; + zend_throw_exception(zend_ce_exception, "Namespace is too long", 0); + return; } if (ZEND_LONG_EXCEEDS_INT(options)) { - php_error_docref(NULL, E_WARNING, "Invalid options"); - RETURN_FALSE; + zend_throw_exception(zend_ce_exception, "Invalid options", 0); + return; } docp = is_url ? xmlReadFile(data, NULL, (int)options) : xmlReadMemory(data, (int)data_len, NULL, NULL, (int)options); diff --git a/ext/simplexml/tests/bug74950.phpt b/ext/simplexml/tests/bug74950.phpt new file mode 100644 index 0000000..f267a07 --- /dev/null +++ b/ext/simplexml/tests/bug74950.phpt @@ -0,0 +1,16 @@ +--TEST-- +Bug #74950 (null pointer deref in zim_simplexml_element_getDocNamespaces) +--SKIPIF-- +<?php +if (!extension_loaded("simplexml")) die("skip SimpleXML not available"); +?> +--FILE-- +<?php +$xml=new SimpleXMLElement(0,9000000000);var_dump($xml->getDocNamespaces())?> +?> +--EXPECTF-- +Fatal error: Uncaught Exception: Invalid options in %sbug74950.php:%d +Stack trace: +#0 %sbug74950.php(%d): SimpleXMLElement->__construct('0', 9000000000) +#1 {main} + thrown in %sbug74950.php on line %d