Skip to content

Commit c5a63a9

Browse files
nielsdosnielsdos
committed
Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2: Fix reference access in dimensions for DOMNodeList and DOMNodeMap
2 parents d20f826 + b8a1041 commit c5a63a9

File tree

4 files changed

+100
-25
lines changed

4 files changed

+100
-25
lines changed

‎NEWS

+2
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@ PHP NEWS
1111
- DOM:
1212
. Fix unlikely memory leak in case of namespace removal with extremely deep
1313
trees. (nielsdos)
14+
. Fix reference access in dimensions for DOMNodeList and DOMNodeMap.
15+
(nielsdos)
1416

1517
- Fileinfo:
1618
. Fixed bug GH-13344 (finfo::buffer(): Failed identify data 0:(null),

‎ext/dom/php_dom.c

+8
Original file line numberDiff line numberDiff line change
@@ -1713,6 +1713,8 @@ static zval *dom_nodelist_read_dimension(zend_object *object, zval *offset, int
17131713
return NULL;
17141714
}
17151715

1716+
ZVAL_DEREF(offset);
1717+
17161718
zend_long lval;
17171719
if (dom_nodemap_or_nodelist_process_offset_as_named(offset, &lval)) {
17181720
/* does not support named lookup */
@@ -1726,6 +1728,8 @@ static zval *dom_nodelist_read_dimension(zend_object *object, zval *offset, int
17261728

17271729
static int dom_nodelist_has_dimension(zend_object *object, zval *member, int check_empty)
17281730
{
1731+
ZVAL_DEREF(member);
1732+
17291733
zend_long offset;
17301734
if (dom_nodemap_or_nodelist_process_offset_as_named(member, &offset)) {
17311735
/* does not support named lookup */
@@ -1785,6 +1789,8 @@ static zval *dom_nodemap_read_dimension(zend_object *object, zval *offset, int t
17851789
return NULL;
17861790
}
17871791

1792+
ZVAL_DEREF(offset);
1793+
17881794
zend_long lval;
17891795
if (dom_nodemap_or_nodelist_process_offset_as_named(offset, &lval)) {
17901796
/* exceptional case, switch to named lookup */
@@ -1804,6 +1810,8 @@ static zval *dom_nodemap_read_dimension(zend_object *object, zval *offset, int t
18041810

18051811
static int dom_nodemap_has_dimension(zend_object *object, zval *member, int check_empty)
18061812
{
1813+
ZVAL_DEREF(member);
1814+
18071815
zend_long offset;
18081816
if (dom_nodemap_or_nodelist_process_offset_as_named(member, &offset)) {
18091817
/* exceptional case, switch to named lookup */

‎ext/dom/tests/DOMNamedNodeMap_string_references.phpt

+64
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
--TEST--
2+
DOMNamedNodeMap string references
3+
--EXTENSIONS--
4+
dom
5+
--FILE--
6+
<?php
7+
8+
$dom = new DOMDocument;
9+
$dom->loadXML('<a href="hi" foo="bar"/>');
10+
11+
$attributes = $dom->documentElement->attributes;
12+
13+
var_dump(isset($attributes['href']), $attributes['href']->value);
14+
15+
var_dump(isset($attributes['foo']), $attributes['foo']->value);
16+
17+
$str = 'href';
18+
$ref =& $str;
19+
var_dump(isset($attributes[$ref]), $attributes[$ref]->value);
20+
21+
$str = 'foo';
22+
$ref =& $str;
23+
var_dump(isset($attributes[$ref]), $attributes[$ref]->value);
24+
25+
$str = 'this does not exist';
26+
$ref =& $str;
27+
var_dump(isset($attributes[$ref]), $attributes[$ref]);
28+
29+
$str = '0';
30+
$ref =& $str;
31+
var_dump(isset($attributes[$ref]), $attributes[$ref]->value);
32+
33+
$str = '1';
34+
$ref =& $str;
35+
var_dump(isset($attributes[$ref]), $attributes[$ref]->value);
36+
37+
$int = 0;
38+
$ref =& $int;
39+
var_dump(isset($attributes[$ref]), $attributes[$ref]->value);
40+
41+
$int = 1;
42+
$ref =& $int;
43+
var_dump(isset($attributes[$ref]), $attributes[$ref]->value);
44+
45+
?>
46+
--EXPECT--
47+
bool(true)
48+
string(2) "hi"
49+
bool(true)
50+
string(3) "bar"
51+
bool(true)
52+
string(2) "hi"
53+
bool(true)
54+
string(3) "bar"
55+
bool(false)
56+
NULL
57+
bool(true)
58+
string(2) "hi"
59+
bool(true)
60+
string(3) "bar"
61+
bool(true)
62+
string(2) "hi"
63+
bool(true)
64+
string(3) "bar"

‎ext/dom/tests/bug67949.phpt

+26-25
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ dom
55
--FILE--
66
<?php
77

8+
// Note: non-numeric string accesses fail on NodeLists (as per spec).
9+
810
$html = <<<HTML
911
<div>data</div>
1012
<a href="test">hello world</a>
@@ -14,57 +16,56 @@ $doc->loadHTML($html);
1416

1517
$nodes = $doc->getElementsByTagName('div');
1618

17-
echo "testing has_dimension\n";
19+
echo "--- testing has_dimension ---\n";
1820
var_dump(isset($nodes[0]));
1921
var_dump(isset($nodes[1]));
2022
var_dump(isset($nodes[-1]));
2123

22-
echo "testing property access\n";
24+
echo "--- testing property access ---\n";
2325
var_dump($nodes[0]->textContent);
2426
var_dump($nodes[1]->textContent);
2527

26-
echo "testing offset not a long\n";
28+
echo "--- testing offset not a long: array ---\n";
2729
$offset = ['test'];
2830
var_dump($offset);
2931
var_dump(isset($nodes[$offset]), $nodes[$offset]->textContent);
30-
var_dump($offset);
3132

32-
$something = 'test';
33+
echo "--- testing offset not a long: Reference to string ---\n";
34+
$something = 'href';
3335
$offset = &$something;
3436

3537
var_dump($offset);
3638
var_dump(isset($nodes[$offset]), $nodes[$offset]->textContent);
37-
var_dump($offset);
3839

40+
echo "--- testing offset not a long: string ---\n";
3941
$offset = 'test';
4042
var_dump($offset);
4143
var_dump(isset($nodes[$offset]), $nodes[$offset]->textContent);
42-
var_dump($offset);
4344

44-
echo "testing read_dimension with null offset\n";
45+
echo "--- testing read_dimension with null offset ---\n";
4546
try {
4647
var_dump($nodes[][] = 1);
4748
} catch (Error $e) {
4849
echo $e->getMessage(), "\n";
4950
}
5051

51-
echo "testing attribute access\n";
52+
echo "--- testing attribute access ---\n";
5253
$anchor = $doc->getElementsByTagName('a')[0];
5354
var_dump($anchor->attributes[0]->name);
5455

5556
echo "==DONE==\n";
5657
?>
5758
--EXPECTF--
58-
testing has_dimension
59+
--- testing has_dimension ---
5960
bool(true)
6061
bool(false)
6162
bool(false)
62-
testing property access
63+
--- testing property access ---
6364
string(4) "data"
6465

6566
Warning: Attempt to read property "textContent" on null in %s on line %d
6667
NULL
67-
testing offset not a long
68+
--- testing offset not a long: array ---
6869
array(1) {
6970
[0]=>
7071
string(4) "test"
@@ -73,20 +74,20 @@ array(1) {
7374
Warning: Attempt to read property "textContent" on null in %s on line %d
7475
bool(false)
7576
NULL
76-
array(1) {
77-
[0]=>
78-
string(4) "test"
79-
}
80-
string(4) "test"
81-
bool(true)
82-
string(4) "data"
83-
string(4) "test"
84-
string(4) "test"
85-
bool(true)
86-
string(4) "data"
77+
--- testing offset not a long: Reference to string ---
78+
string(4) "href"
79+
80+
Warning: Attempt to read property "textContent" on null in %s on line %d
81+
bool(false)
82+
NULL
83+
--- testing offset not a long: string ---
8784
string(4) "test"
88-
testing read_dimension with null offset
85+
86+
Warning: Attempt to read property "textContent" on null in %s on line %d
87+
bool(false)
88+
NULL
89+
--- testing read_dimension with null offset ---
8990
Cannot access DOMNodeList without offset
90-
testing attribute access
91+
--- testing attribute access ---
9192
string(4) "href"
9293
==DONE==

0 commit comments

Comments
 (0)