Skip to content

Commit ddcf5d7

Browse files
nielsdosnielsdos
committed
Merge branch 'PHP-8.3'
* PHP-8.3: Fix reference access in dimensions for DOMNodeList and DOMNodeMap
2 parents dbf0b6a + c5a63a9 commit ddcf5d7

File tree

3 files changed

+98
-25
lines changed

3 files changed

+98
-25
lines changed

‎ext/dom/php_dom.c

+8
Original file line numberDiff line numberDiff line change
@@ -1770,6 +1770,8 @@ static zval *dom_nodelist_read_dimension(zend_object *object, zval *offset, int
17701770
return NULL;
17711771
}
17721772

1773+
ZVAL_DEREF(offset);
1774+
17731775
zend_long lval;
17741776
if (dom_nodemap_or_nodelist_process_offset_as_named(offset, &lval)) {
17751777
/* does not support named lookup */
@@ -1783,6 +1785,8 @@ static zval *dom_nodelist_read_dimension(zend_object *object, zval *offset, int
17831785

17841786
static int dom_nodelist_has_dimension(zend_object *object, zval *member, int check_empty)
17851787
{
1788+
ZVAL_DEREF(member);
1789+
17861790
zend_long offset;
17871791
if (dom_nodemap_or_nodelist_process_offset_as_named(member, &offset)) {
17881792
/* does not support named lookup */
@@ -1842,6 +1846,8 @@ static zval *dom_nodemap_read_dimension(zend_object *object, zval *offset, int t
18421846
return NULL;
18431847
}
18441848

1849+
ZVAL_DEREF(offset);
1850+
18451851
zend_long lval;
18461852
if (dom_nodemap_or_nodelist_process_offset_as_named(offset, &lval)) {
18471853
/* exceptional case, switch to named lookup */
@@ -1861,6 +1867,8 @@ static zval *dom_nodemap_read_dimension(zend_object *object, zval *offset, int t
18611867

18621868
static int dom_nodemap_has_dimension(zend_object *object, zval *member, int check_empty)
18631869
{
1870+
ZVAL_DEREF(member);
1871+
18641872
zend_long offset;
18651873
if (dom_nodemap_or_nodelist_process_offset_as_named(member, &offset)) {
18661874
/* exceptional case, switch to named lookup */

‎ext/dom/tests/DOMNamedNodeMap_string_references.phpt

+64
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
--TEST--
2+
DOMNamedNodeMap string references
3+
--EXTENSIONS--
4+
dom
5+
--FILE--
6+
<?php
7+
8+
$dom = new DOMDocument;
9+
$dom->loadXML('<a href="hi" foo="bar"/>');
10+
11+
$attributes = $dom->documentElement->attributes;
12+
13+
var_dump(isset($attributes['href']), $attributes['href']->value);
14+
15+
var_dump(isset($attributes['foo']), $attributes['foo']->value);
16+
17+
$str = 'href';
18+
$ref =& $str;
19+
var_dump(isset($attributes[$ref]), $attributes[$ref]->value);
20+
21+
$str = 'foo';
22+
$ref =& $str;
23+
var_dump(isset($attributes[$ref]), $attributes[$ref]->value);
24+
25+
$str = 'this does not exist';
26+
$ref =& $str;
27+
var_dump(isset($attributes[$ref]), $attributes[$ref]);
28+
29+
$str = '0';
30+
$ref =& $str;
31+
var_dump(isset($attributes[$ref]), $attributes[$ref]->value);
32+
33+
$str = '1';
34+
$ref =& $str;
35+
var_dump(isset($attributes[$ref]), $attributes[$ref]->value);
36+
37+
$int = 0;
38+
$ref =& $int;
39+
var_dump(isset($attributes[$ref]), $attributes[$ref]->value);
40+
41+
$int = 1;
42+
$ref =& $int;
43+
var_dump(isset($attributes[$ref]), $attributes[$ref]->value);
44+
45+
?>
46+
--EXPECT--
47+
bool(true)
48+
string(2) "hi"
49+
bool(true)
50+
string(3) "bar"
51+
bool(true)
52+
string(2) "hi"
53+
bool(true)
54+
string(3) "bar"
55+
bool(false)
56+
NULL
57+
bool(true)
58+
string(2) "hi"
59+
bool(true)
60+
string(3) "bar"
61+
bool(true)
62+
string(2) "hi"
63+
bool(true)
64+
string(3) "bar"

‎ext/dom/tests/bug67949.phpt

+26-25
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ dom
55
--FILE--
66
<?php
77

8+
// Note: non-numeric string accesses fail on NodeLists (as per spec).
9+
810
$html = <<<HTML
911
<div>data</div>
1012
<a href="test">hello world</a>
@@ -14,57 +16,56 @@ $doc->loadHTML($html);
1416

1517
$nodes = $doc->getElementsByTagName('div');
1618

17-
echo "testing has_dimension\n";
19+
echo "--- testing has_dimension ---\n";
1820
var_dump(isset($nodes[0]));
1921
var_dump(isset($nodes[1]));
2022
var_dump(isset($nodes[-1]));
2123

22-
echo "testing property access\n";
24+
echo "--- testing property access ---\n";
2325
var_dump($nodes[0]->textContent);
2426
var_dump($nodes[1]->textContent);
2527

26-
echo "testing offset not a long\n";
28+
echo "--- testing offset not a long: array ---\n";
2729
$offset = ['test'];
2830
var_dump($offset);
2931
var_dump(isset($nodes[$offset]), $nodes[$offset]->textContent);
30-
var_dump($offset);
3132

32-
$something = 'test';
33+
echo "--- testing offset not a long: Reference to string ---\n";
34+
$something = 'href';
3335
$offset = &$something;
3436

3537
var_dump($offset);
3638
var_dump(isset($nodes[$offset]), $nodes[$offset]->textContent);
37-
var_dump($offset);
3839

40+
echo "--- testing offset not a long: string ---\n";
3941
$offset = 'test';
4042
var_dump($offset);
4143
var_dump(isset($nodes[$offset]), $nodes[$offset]->textContent);
42-
var_dump($offset);
4344

44-
echo "testing read_dimension with null offset\n";
45+
echo "--- testing read_dimension with null offset ---\n";
4546
try {
4647
var_dump($nodes[][] = 1);
4748
} catch (Error $e) {
4849
echo $e->getMessage(), "\n";
4950
}
5051

51-
echo "testing attribute access\n";
52+
echo "--- testing attribute access ---\n";
5253
$anchor = $doc->getElementsByTagName('a')[0];
5354
var_dump($anchor->attributes[0]->name);
5455

5556
echo "==DONE==\n";
5657
?>
5758
--EXPECTF--
58-
testing has_dimension
59+
--- testing has_dimension ---
5960
bool(true)
6061
bool(false)
6162
bool(false)
62-
testing property access
63+
--- testing property access ---
6364
string(4) "data"
6465

6566
Warning: Attempt to read property "textContent" on null in %s on line %d
6667
NULL
67-
testing offset not a long
68+
--- testing offset not a long: array ---
6869
array(1) {
6970
[0]=>
7071
string(4) "test"
@@ -73,20 +74,20 @@ array(1) {
7374
Warning: Attempt to read property "textContent" on null in %s on line %d
7475
bool(false)
7576
NULL
76-
array(1) {
77-
[0]=>
78-
string(4) "test"
79-
}
80-
string(4) "test"
81-
bool(true)
82-
string(4) "data"
83-
string(4) "test"
84-
string(4) "test"
85-
bool(true)
86-
string(4) "data"
77+
--- testing offset not a long: Reference to string ---
78+
string(4) "href"
79+
80+
Warning: Attempt to read property "textContent" on null in %s on line %d
81+
bool(false)
82+
NULL
83+
--- testing offset not a long: string ---
8784
string(4) "test"
88-
testing read_dimension with null offset
85+
86+
Warning: Attempt to read property "textContent" on null in %s on line %d
87+
bool(false)
88+
NULL
89+
--- testing read_dimension with null offset ---
8990
Cannot access DOMNodeList without offset
90-
testing attribute access
91+
--- testing attribute access ---
9192
string(4) "href"
9293
==DONE==

0 commit comments

Comments
 (0)