Fixed bug #79029 (Use After Free's in XMLReader / XMLWriter).

We backport the fix PHP 7.3, since this branch is affected as well.

(cherry picked from commit b5e0043)
(cherry picked from commit e36daa6)
(cherry picked from commit 2704ee6)

Author: laruence

NEWS

@@ -17,6 +17,9 @@ PHP                                                                        NEWS
   . Fixed bug #78923 (Artifacts when convoluting image with transparency).
     (wilson chen)
 
+- Libxml:
+  . Fixed bug #79029 (Use After Free's in XMLReader / XMLWriter). (Laruence)
+
 - Pcntl:
   . Fixed bug #78402 (Converting null to string in error message is bad DX).
     (SATŌ Kentarō)

ext/libxml/libxml.c

@@ -358,6 +358,10 @@ static void *php_libxml_streams_IO_open_wrapper(const char *filename, const char
 	context = php_stream_context_from_zval(Z_ISUNDEF(LIBXML(stream_context))? NULL : &LIBXML(stream_context), 0);
 
 	ret_val = php_stream_open_wrapper_ex(path_to_open, (char *)mode, REPORT_ERRORS, NULL, context);
+	if (ret_val) {
+		/* Prevent from closing this by fclose() */
+		((php_stream*)ret_val)->flags |= PHP_STREAM_FLAG_NO_FCLOSE;
+	}
 	if (isescaped) {
 		xmlFree(resolved_path);
 	}

ext/xmlwriter/php_xmlwriter.c

@@ -91,13 +91,15 @@ typedef int (*xmlwriter_read_int_t)(xmlTextWriterPtr writer);
 static void xmlwriter_free_resource_ptr(xmlwriter_object *intern)
 {
 	if (intern) {
-		if (intern->ptr) {
-			xmlFreeTextWriter(intern->ptr);
-			intern->ptr = NULL;
-		}
-		if (intern->output) {
-			xmlBufferFree(intern->output);
-			intern->output = NULL;
+		if (EG(active)) {
+			if (intern->ptr) {
+				xmlFreeTextWriter(intern->ptr);
+				intern->ptr = NULL;
+			}
+			if (intern->output) {
+				xmlBufferFree(intern->output);
+				intern->output = NULL;
+			}
 		}
 		efree(intern);
 	}

ext/xmlwriter/tests/bug79029.phpt

@@ -0,0 +1,34 @@
+--TEST--
+#79029 (Use After Free's in XMLReader / XMLWriter)
+--SKIPIF--
+<?php 
+if (!extension_loaded("xmlwriter")) print "skip xmlwriter extension not available";
+if (!extension_loaded("xmlreader")) print "skip xmlreader extension not available";
+?>
+--FILE--
+<?php
+$x = array( new XMLWriter() );
+$x[0]->openUri("bug79029_1.txt");
+$x[0]->startComment();
+
+$x = new XMLWriter();
+$x->openUri("bug79029_2.txt");
+fclose(@end(get_resources()));
+
+file_put_contents("bug79029_3.txt", "a");
+$x = new XMLReader();
+$x->open("bug79029_3.txt");
+fclose(@end(get_resources()));
+?>
+okey
+--CLEAN--
+<?php
+@unlink("bug79029_1.txt");
+@unlink("bug79029_2.txt");
+@unlink("bug79029_3.txt");
+?>
+--EXPECTF--
+Warning: fclose(): %d is not a valid stream resource in %sbug79029.php on line %d
+
+Warning: fclose(): %d is not a valid stream resource in %sbug79029.php on line %d
+okey