clones/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-09-21 09:57:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix incorrect error handling in dom_zvals_to_fragment()

Browse Source 
Discovered this pre-existing problem while testing GH-10682.
Note: this problem existed *before* that PR.

* Not all paths throw a hierarchy request error
* xmlFreeNode must be used instead of xmlFree for the fragment to also
  free its children.
* Free up nodes that couldn't be added when xmlAddChild fails.

I unified the error handling code that's exactly the same with a goto to
prevent at least some of such problems in the future.

Closes GH-10981.
This commit is contained in:
Niels Dossche 2023-03-30 21:28:09 +02:00
parent 3a21a87443
commit 0579beb842
2 changed files with 14 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
NEWS
View File

@ -12,6 +12,7 @@ PHP NEWS
- DOM:
. Fixed bug #80602 (Segfault when using DOMChildNode::before()).
(Nathan Freeman)
. Fixed incorrect error handling in dom_zvals_to_fragment(). (nielsdos)
- PCRE:
. Fixed bug GH-10968 (Segfault in preg_replace_callback_array()). (ilutov)

33
ext/dom/parentnode.c
View File

@ -162,9 +162,8 @@ xmlNode* dom_zvals_to_fragment(php_libxml_ref_obj *document, xmlNode *contextNod
newNode = dom_object_get_node(newNodeObj);
if (newNode->doc != documentNode) {
xmlFree(fragment);
php_dom_throw_error(WRONG_DOCUMENT_ERR, stricterror);
return NULL;
goto err;
}
if (newNode->parent != NULL) {
@ -175,10 +174,7 @@ xmlNode* dom_zvals_to_fragment(php_libxml_ref_obj *document, xmlNode *contextNod
xmlSetTreeDoc(newNode, documentNode);
if (newNode->type == XML_ATTRIBUTE_NODE) {
xmlFree(fragment);
php_dom_throw_error(HIERARCHY_REQUEST_ERR, stricterror);
return NULL;
goto hierarchy_request_err;
}
/*
@ -191,21 +187,16 @@ xmlNode* dom_zvals_to_fragment(php_libxml_ref_obj *document, xmlNode *contextNod
}
if (!xmlAddChild(fragment, newNode)) {
xmlFree(fragment);
if (nodesc > 1) {
xmlFreeNode(newNode);
}
php_dom_throw_error(HIERARCHY_REQUEST_ERR, stricterror);
return NULL;
goto hierarchy_request_err;
}
continue;
} else {
xmlFree(fragment);
zend_argument_type_error(i + 1, "must be of type DOMNode|string, %s given", zend_zval_type_name(&nodes[i]));
return NULL;
goto err;
}
} else if (Z_TYPE(nodes[i]) == IS_STRING) {
newNode = xmlNewDocText(documentNode, (xmlChar *) Z_STRVAL(nodes[i]));
@ -213,20 +204,22 @@ xmlNode* dom_zvals_to_fragment(php_libxml_ref_obj *document, xmlNode *contextNod
xmlSetTreeDoc(newNode, documentNode);
if (!xmlAddChild(fragment, newNode)) {
xmlFree(fragment);
return NULL;
xmlFreeNode(newNode);
goto hierarchy_request_err;
}
} else {
xmlFree(fragment);
zend_argument_type_error(i + 1, "must be of type DOMNode|string, %s given", zend_zval_type_name(&nodes[i]));
return NULL;
goto err;
}
}
return fragment;
hierarchy_request_err:
php_dom_throw_error(HIERARCHY_REQUEST_ERR, stricterror);
err:
xmlFreeNode(fragment);
return NULL;
}
static void dom_fragment_assign_parent_node(xmlNodePtr parentNode, xmlNodePtr fragment)