Fix #73246: XMLReader: encoding length not checked

libxml2 expects the passed encoding to be NUL terminated, so we reject
strings with NUL bytes right away.

Closes GH-6899.

Author: cmb69

NEWS

@@ -31,6 +31,9 @@ PHP                                                                        NEWS
 - Opcache:
   . Fixed bug #80900 (switch statement behavior inside function). (twosee)
 
+- XMLReader:
+  . Fixed bug #73246 (XMLReader: encoding length not checked). (cmb)
+
 29 Apr 2021, PHP 7.4.18
 
 - Core:

ext/xmlreader/php_xmlreader.c

@@ -873,6 +873,11 @@ PHP_METHOD(xmlreader, open)
 		RETURN_FALSE;
 	}
 
+	if (encoding && CHECK_NULL_PATH(encoding, encoding_len)) {
+		php_error_docref(NULL, E_WARNING, "Encoding must not contain NUL bytes");
+		RETURN_FALSE;
+	}
+
 	valid_file = _xmlreader_get_valid_file_path(source, resolved_path, MAXPATHLEN );
 
 	if (valid_file) {
@@ -1055,6 +1060,11 @@ PHP_METHOD(xmlreader, XML)
 		RETURN_FALSE;
 	}
 
+	if (encoding && CHECK_NULL_PATH(encoding, encoding_len)) {
+		php_error_docref(NULL, E_WARNING, "Encoding must not contain NUL bytes");
+		RETURN_FALSE;
+	}
+
 	inputbfr = xmlParserInputBufferCreateMem(source, source_len, XML_CHAR_ENCODING_NONE);
 
     if (inputbfr != NULL) {

ext/xmlreader/tests/bug73246.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Bug #73246 (XMLReader: encoding length not checked)
+--SKIPIF--
+<?php
+if (!extension_loaded("xmlreader")) die("skip xmlreader extension not available");
+?>
+--FILE--
+<?php
+$reader = new XMLReader();
+$reader->open(__FILE__, "UTF\0-8");
+$reader->XML('<?xml version="1.0"?><root/>', "UTF\0-8");
+?>
+--EXPECTF--
+Warning: XMLReader::open(): Encoding must not contain NUL bytes in %s on line %d
+
+Warning: XMLReader::XML(): Encoding must not contain NUL bytes in %s on line %d