Skip to content

Commit 0c18ffe

Browse files
NathanFreemanNathanFreeman
committed
Fix bug #80332
1 parent 2c53d63 commit 0c18ffe

File tree

4 files changed

+113
-6
lines changed

4 files changed

+113
-6
lines changed

‎NEWS

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -355,6 +355,8 @@ PHP NEWS
355355
- DOM:
356356
. Fixed bug #79451 (DOMDocument->replaceChild on doctype causes double free).
357357
(Nathan Freeman)
358+
. Fixed bug #80332 (Completely broken array access functionality with
359+
DOMNamedNodeMap). (Nathan Freeman)
358360

359361
- FPM:
360362
. Fixed bug GH-8885 (FPM access.log with stderr begins to write logs to

‎ext/dom/php_dom.c

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
#endif
2222

2323
#include "php.h"
24+
2425
#if defined(HAVE_LIBXML) && defined(HAVE_DOM)
2526
#include "ext/standard/php_rand.h"
2627
#include "php_dom.h"
@@ -1519,7 +1520,14 @@ static zval *dom_nodelist_read_dimension(zend_object *object, zval *offset, int
15191520
return NULL;
15201521
}
15211522

1522-
ZVAL_LONG(&offset_copy, zval_get_long(offset));
1523+
zend_long lval;
1524+
if (Z_TYPE_P(offset) == IS_LONG) {
1525+
ZVAL_LONG(&offset_copy, Z_LVAL_P(offset));
1526+
} else if (Z_TYPE_P(offset) == IS_STRING && is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), &lval, NULL, false) == IS_LONG) {
1527+
ZVAL_LONG(&offset_copy, lval);
1528+
} else {
1529+
return NULL;
1530+
}
15231531

15241532
zend_call_method_with_1_params(object, object->ce, NULL, "item", rv, &offset_copy);
15251533

@@ -1528,7 +1536,14 @@ static zval *dom_nodelist_read_dimension(zend_object *object, zval *offset, int
15281536

15291537
static int dom_nodelist_has_dimension(zend_object *object, zval *member, int check_empty)
15301538
{
1531-
zend_long offset = zval_get_long(member);
1539+
zend_long lval;
1540+
zend_long offset = -1;
1541+
if (Z_TYPE_P(member) == IS_LONG) {
1542+
offset = Z_LVAL_P(member);
1543+
} else if (Z_TYPE_P(member) == IS_STRING && is_numeric_string(Z_STRVAL_P(member), Z_STRLEN_P(member), &lval, NULL, false) == IS_LONG) {
1544+
offset = lval;
1545+
}
1546+
15321547
zval rv;
15331548

15341549
if (offset < 0) {

‎ext/dom/tests/bug67949.phpt

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -78,12 +78,16 @@ array(1) {
7878
string(4) "test"
7979
}
8080
string(4) "test"
81-
bool(true)
82-
string(4) "data"
81+
82+
Warning: Attempt to read property "textContent" on null in %s on line %d
83+
bool(false)
84+
NULL
8385
string(4) "test"
8486
string(4) "test"
85-
bool(true)
86-
string(4) "data"
87+
88+
Warning: Attempt to read property "textContent" on null in %s on line %d
89+
bool(false)
90+
NULL
8791
string(4) "test"
8892
testing read_dimension with null offset
8993
Cannot access node list without offset

‎ext/dom/tests/bug80332.phpt

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
--TEST--
2+
Bug #80332 (Completely broken array access functionality with DOMNamedNodeMap)
3+
--EXTENSIONS--
4+
dom
5+
--FILE--
6+
<?php
7+
$doc = new DOMDocument;
8+
$doc->loadHTML('<span attr1="value1" attr2="value2"></span>');
9+
10+
$x = new DOMXPath($doc);
11+
$span = $x->query('//span')[0];
12+
13+
var_dump($span->attributes[0]->nodeName);
14+
var_dump($span->attributes[0]->nodeValue);
15+
16+
var_dump($span->attributes['1']->nodeName);
17+
var_dump($span->attributes['1']->nodeValue);
18+
19+
var_dump($span->attributes[0.6]->nodeName);
20+
var_dump($span->attributes[0.6]->nodeValue);
21+
22+
var_dump($span->attributes['0.6']->nodeName);
23+
var_dump($span->attributes['0.6']->nodeValue);
24+
25+
var_dump($span->attributes[12345678]->nodeName);
26+
var_dump($span->attributes[12345678]->nodeValue);
27+
28+
var_dump($span->attributes['12345678']->nodeName);
29+
var_dump($span->attributes['12345678']->nodeValue);
30+
31+
var_dump($span->attributes[9999999999999999999999999999999999]->nodeName);
32+
var_dump($span->attributes[9999999999999999999999999999999999]->nodeValue);
33+
34+
var_dump($span->attributes['9999999999999999999999999999999999']->nodeName);
35+
var_dump($span->attributes['9999999999999999999999999999999999']->nodeValue);
36+
37+
var_dump($span->attributes['hi']->nodeName);
38+
var_dump($span->attributes['hi']->nodeValue);
39+
?>
40+
--EXPECTF--
41+
string(5) "attr1"
42+
string(6) "value1"
43+
string(5) "attr2"
44+
string(6) "value2"
45+
46+
Warning: Attempt to read property "nodeName" on null in %s on line %d
47+
NULL
48+
49+
Warning: Attempt to read property "nodeValue" on null in %s on line %d
50+
NULL
51+
52+
Warning: Attempt to read property "nodeName" on null in %s on line %d
53+
NULL
54+
55+
Warning: Attempt to read property "nodeValue" on null in %s on line %d
56+
NULL
57+
58+
Warning: Attempt to read property "nodeName" on null in %s on line %d
59+
NULL
60+
61+
Warning: Attempt to read property "nodeValue" on null in %s on line %d
62+
NULL
63+
64+
Warning: Attempt to read property "nodeName" on null in %s on line %d
65+
NULL
66+
67+
Warning: Attempt to read property "nodeValue" on null in %s on line %d
68+
NULL
69+
70+
Warning: Attempt to read property "nodeName" on null in %s on line %d
71+
NULL
72+
73+
Warning: Attempt to read property "nodeValue" on null in %s on line %d
74+
NULL
75+
76+
Warning: Attempt to read property "nodeName" on null in %s on line %d
77+
NULL
78+
79+
Warning: Attempt to read property "nodeValue" on null in %s on line %d
80+
NULL
81+
82+
Warning: Attempt to read property "nodeName" on null in %s on line %d
83+
NULL
84+
85+
Warning: Attempt to read property "nodeValue" on null in %s on line %d
86+
NULL

0 commit comments

Comments
 (0)