com php-src: Fix #71606: Segmentation fault mb_strcut with HTML-ENTITIES: NEWS ext/mbstring/libmbfl/filters/mbfil ter_htmlent.c
ext/mbstring/libmbfl/filters/mbfilter_htm lent.h ext/mbstring/tests/bug71606.phpt

Commit: 418da85f1528172fb9df376c17f0fd79faf4aebf Author: Christoph M. Becker <cmb@php.net> Sat, 30 Jul 2016 16:58:43 +0200 Committer: Nikita Popov <nikita.ppv@gmail.com> Sun, 23 Jul 2017 12:19:27 +0200 Parents: 775b4b54d81572878de5166fd717511799b92b7c Branches: PHP-7.0 PHP-7.1 PHP-7.2 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=418da85f1528172fb9df376c17f0fd79faf4aebf Log: Fix #71606: Segmentation fault mb_strcut with HTML-ENTITIES The HTML decoding filter uses the opaque member of mbfl_convert_filter as buffer, but there was no copy constructor defined, what caused double frees when the filter is copied (what happens multiple times in mb_strcut(), for instance). Bugs: https://bugs.php.net/71606 Changed paths: M NEWS M ext/mbstring/libmbfl/filters/mbfilter_htmlent.c M ext/mbstring/libmbfl/filters/mbfilter_htmlent.h A ext/mbstring/tests/bug71606.phpt Diff: diff --git a/NEWS b/NEWS index b8da83c..f82a0f3 100644 --- a/NEWS +++ b/NEWS @@ -6,6 +6,10 @@ PHP NEWS . Fixed bug #74947 (Segfault in scanner on INF number). (Laruence) . Fixed bug #74954 (null deref and segfault in zend_generator_resume()). (Bob) +- Mbstring: + . Fixed bug #71606 (Segmentation fault mb_strcut with HTML-ENTITIES encoding). + (cmb) + - MySQLi: . Fixed bug #74968 (PHP crashes when calling mysqli_result::fetch_object with an abstract class).. (Anatol) diff --git a/ext/mbstring/libmbfl/filters/mbfilter_htmlent.c b/ext/mbstring/libmbfl/filters/mbfilter_htmlent.c index 9d530ab..03b26cc 100644 --- a/ext/mbstring/libmbfl/filters/mbfilter_htmlent.c +++ b/ext/mbstring/libmbfl/filters/mbfilter_htmlent.c @@ -88,7 +88,8 @@ const struct mbfl_convert_vtbl vtbl_html_wchar = { mbfl_filt_conv_html_dec_ctor, mbfl_filt_conv_html_dec_dtor, mbfl_filt_conv_html_dec, - mbfl_filt_conv_html_dec_flush }; + mbfl_filt_conv_html_dec_flush, + mbfl_filt_conv_html_dec_copy }; #define CK(statement) do { if ((statement) < 0) return (-1); } while (0) @@ -309,4 +310,9 @@ int mbfl_filt_conv_html_dec_flush(mbfl_convert_filter *filter) return err; } - +void mbfl_filt_conv_html_dec_copy(mbfl_convert_filter *src, mbfl_convert_filter *dest) +{ + *dest = *src; + dest->opaque = mbfl_malloc(html_enc_buffer_size+1); + memcpy(dest->opaque, src->opaque, html_enc_buffer_size+1); +} diff --git a/ext/mbstring/libmbfl/filters/mbfilter_htmlent.h b/ext/mbstring/libmbfl/filters/mbfilter_htmlent.h index 6b6ce49..979f601 100644 --- a/ext/mbstring/libmbfl/filters/mbfilter_htmlent.h +++ b/ext/mbstring/libmbfl/filters/mbfilter_htmlent.h @@ -42,6 +42,7 @@ int mbfl_filt_conv_html_enc(int c, mbfl_convert_filter *filter); int mbfl_filt_conv_html_enc_flush(mbfl_convert_filter *filter); int mbfl_filt_conv_html_dec(int c, mbfl_convert_filter *filter); int mbfl_filt_conv_html_dec_flush(mbfl_convert_filter *filter); +void mbfl_filt_conv_html_dec_copy(mbfl_convert_filter *src, mbfl_convert_filter *dest); void mbfl_filt_conv_html_dec_ctor(mbfl_convert_filter *filter); void mbfl_filt_conv_html_dec_dtor(mbfl_convert_filter *filter); diff --git a/ext/mbstring/tests/bug71606.phpt b/ext/mbstring/tests/bug71606.phpt new file mode 100644 index 0000000..a09d7ad --- /dev/null +++ b/ext/mbstring/tests/bug71606.phpt @@ -0,0 +1,13 @@ +--TEST-- +Bug #71606 (Segmentation fault mb_strcut + mb_list_encodings) +--SKIPIF-- +<?php +if (!extension_loaded('mbstring')) die('skip ext/mbstring not available'); +?> +--FILE-- +<?php +echo mb_strcut('&quot;', 0, 0, 'HTML-ENTITIES'); +echo 'DONE', PHP_EOL; +?> +--EXPECT-- +DONE