mirror of
https://github.com/php/php-src.git
synced 2024-09-21 09:57:23 +00:00
Fix incorrect error handling in dom_zvals_to_fragment()
Discovered this pre-existing problem while testing GH-10682. Note: this problem existed *before* that PR. * Not all paths throw a hierarchy request error * xmlFreeNode must be used instead of xmlFree for the fragment to also free its children. * Free up nodes that couldn't be added when xmlAddChild fails. I unified the error handling code that's exactly the same with a goto to prevent at least some of such problems in the future. Closes GH-10981.
This commit is contained in:
parent
3a21a87443
commit
0579beb842
1
NEWS
1
NEWS
@ -12,6 +12,7 @@ PHP NEWS
|
||||
- DOM:
|
||||
. Fixed bug #80602 (Segfault when using DOMChildNode::before()).
|
||||
(Nathan Freeman)
|
||||
. Fixed incorrect error handling in dom_zvals_to_fragment(). (nielsdos)
|
||||
|
||||
- PCRE:
|
||||
. Fixed bug GH-10968 (Segfault in preg_replace_callback_array()). (ilutov)
|
||||
|
@ -162,9 +162,8 @@ xmlNode* dom_zvals_to_fragment(php_libxml_ref_obj *document, xmlNode *contextNod
|
||||
newNode = dom_object_get_node(newNodeObj);
|
||||
|
||||
if (newNode->doc != documentNode) {
|
||||
xmlFree(fragment);
|
||||
php_dom_throw_error(WRONG_DOCUMENT_ERR, stricterror);
|
||||
return NULL;
|
||||
goto err;
|
||||
}
|
||||
|
||||
if (newNode->parent != NULL) {
|
||||
@ -175,10 +174,7 @@ xmlNode* dom_zvals_to_fragment(php_libxml_ref_obj *document, xmlNode *contextNod
|
||||
xmlSetTreeDoc(newNode, documentNode);
|
||||
|
||||
if (newNode->type == XML_ATTRIBUTE_NODE) {
|
||||
xmlFree(fragment);
|
||||
|
||||
php_dom_throw_error(HIERARCHY_REQUEST_ERR, stricterror);
|
||||
return NULL;
|
||||
goto hierarchy_request_err;
|
||||
}
|
||||
|
||||
/*
|
||||
@ -191,21 +187,16 @@ xmlNode* dom_zvals_to_fragment(php_libxml_ref_obj *document, xmlNode *contextNod
|
||||
}
|
||||
|
||||
if (!xmlAddChild(fragment, newNode)) {
|
||||
xmlFree(fragment);
|
||||
if (nodesc > 1) {
|
||||
xmlFreeNode(newNode);
|
||||
}
|
||||
|
||||
php_dom_throw_error(HIERARCHY_REQUEST_ERR, stricterror);
|
||||
return NULL;
|
||||
goto hierarchy_request_err;
|
||||
}
|
||||
|
||||
continue;
|
||||
} else {
|
||||
xmlFree(fragment);
|
||||
|
||||
zend_argument_type_error(i + 1, "must be of type DOMNode|string, %s given", zend_zval_type_name(&nodes[i]));
|
||||
return NULL;
|
||||
goto err;
|
||||
}
|
||||
} else if (Z_TYPE(nodes[i]) == IS_STRING) {
|
||||
newNode = xmlNewDocText(documentNode, (xmlChar *) Z_STRVAL(nodes[i]));
|
||||
@ -213,20 +204,22 @@ xmlNode* dom_zvals_to_fragment(php_libxml_ref_obj *document, xmlNode *contextNod
|
||||
xmlSetTreeDoc(newNode, documentNode);
|
||||
|
||||
if (!xmlAddChild(fragment, newNode)) {
|
||||
xmlFree(fragment);
|
||||
|
||||
return NULL;
|
||||
xmlFreeNode(newNode);
|
||||
goto hierarchy_request_err;
|
||||
}
|
||||
} else {
|
||||
xmlFree(fragment);
|
||||
|
||||
zend_argument_type_error(i + 1, "must be of type DOMNode|string, %s given", zend_zval_type_name(&nodes[i]));
|
||||
|
||||
return NULL;
|
||||
goto err;
|
||||
}
|
||||
}
|
||||
|
||||
return fragment;
|
||||
|
||||
hierarchy_request_err:
|
||||
php_dom_throw_error(HIERARCHY_REQUEST_ERR, stricterror);
|
||||
err:
|
||||
xmlFreeNode(fragment);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
static void dom_fragment_assign_parent_node(xmlNodePtr parentNode, xmlNodePtr fragment)
|
||||
|
Loading…
Reference in New Issue
Block a user