Merge branch 'PHP-8.3'

* PHP-8.3:
  Fix GH-15837: Segmentation fault in ext/simplexml/simplexml.c
This commit is contained in:
Niels Dossche 2024-09-11 20:40:01 +02:00
commit 0d9b039568
No known key found for this signature in database
GPG Key ID: B8A8AD166DF0E2E5
3 changed files with 39 additions and 0 deletions

4
NEWS
View File

@ -12,6 +12,10 @@ PHP NEWS
- PCRE:
. Fix UAF issues with PCRE after request shutdown. (nielsdos)
- SimpleXML:
. Fixed bug GH-15837 (Segmentation fault in ext/simplexml/simplexml.c).
(nielsdos)
- SOAP:
. Fixed bug #73182 (PHP SOAPClient does not support stream context HTTP
headers in array form). (nielsdos)

View File

@ -2487,6 +2487,11 @@ static void php_sxe_iterator_current_key(zend_object_iterator *iter, zval *key)
{
php_sxe_iterator *iterator = (php_sxe_iterator *)iter;
zval *curobj = &iterator->sxe->iter.data;
if (Z_ISUNDEF_P(curobj)) {
ZVAL_NULL(key);
return;
}
php_sxe_object *intern = Z_SXEOBJ_P(curobj);
xmlNodePtr curnode = NULL;

View File

@ -0,0 +1,30 @@
--TEST--
GH-15837 (Segmentation fault in ext/simplexml/simplexml.c)
--CREDITS--
YuanchengJiang
--FILE--
<?php
$xml =<<<EOF
<xml>
<fieldset1>
</fieldset1>
<fieldset2>
<options>
</options>
</fieldset2>
</xml>
EOF;
$sxe = new SimpleXMLIterator($xml);
$rit = new RecursiveIteratorIterator($sxe, RecursiveIteratorIterator::LEAVES_ONLY);
foreach ($rit as $child) {
$ancestry = $child->xpath('ancestor-or-self::*');
// Exhaust internal iterator
foreach ($ancestry as $ancestor) {
}
}
var_dump($rit->valid());
var_dump($rit->key());
?>
--EXPECT--
bool(false)
NULL