Skip to content

Commit ce4d80a

Browse files
committed
Merge branch 'PHP-7.4'
* PHP-7.4: Fixed bug #79029 (Use After Free's in XMLReader / XMLWriter).
2 parents 66a591a + e36daa6 commit ce4d80a

File tree

3 files changed

+36
-13
lines changed

3 files changed

+36
-13
lines changed

ext/libxml/libxml.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -327,6 +327,10 @@ static void *php_libxml_streams_IO_open_wrapper(const char *filename, const char
327327
context = php_stream_context_from_zval(Z_ISUNDEF(LIBXML(stream_context))? NULL : &LIBXML(stream_context), 0);
328328

329329
ret_val = php_stream_open_wrapper_ex(path_to_open, (char *)mode, REPORT_ERRORS, NULL, context);
330+
if (ret_val) {
331+
/* Prevent from closing this by fclose() */
332+
((php_stream*)ret_val)->flags |= PHP_STREAM_FLAG_NO_FCLOSE;
333+
}
330334
if (isescaped) {
331335
xmlFree(resolved_path);
332336
}

ext/xmlwriter/tests/bug79029.phpt

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
--TEST--
2+
#79029 (Use After Free's in XMLReader / XMLWriter)
3+
--SKIPIF--
4+
<?php if (!extension_loaded("xmlwriter")) print "skip"; ?>
5+
--FILE--
6+
<?php
7+
$x = array( new XMLWriter() );
8+
$x[0]->openUri("bug79029.txt");
9+
$x[0]->startComment();
10+
@unlink("bug79029.txt");
11+
12+
$x = new XMLWriter();
13+
$x->openUri("bug79029.txt");
14+
fclose(@end(get_resources()));
15+
@unlink("bug79029.txt");
16+
17+
file_put_contents("bug79029.txt", "a");
18+
$x = new XMLReader();
19+
$x->open("bug79029.txt");
20+
fclose(@end(get_resources()));
21+
@unlink("bug79029.txt");
22+
?>
23+
okey
24+
--CLEAN--
25+
<?php
26+
@unlink("bug79029.txt");
27+
?>
28+
--EXPECTF--
29+
Warning: fclose(): %d is not a valid stream resource in %sbug79029.php on line %d
30+
31+
Warning: fclose(): %d is not a valid stream resource in %sbug79029.php on line %d
32+
okey

ext/xmlwriter/tests/bug79029_1.phpt

Lines changed: 0 additions & 13 deletions
This file was deleted.

0 commit comments

Comments
 (0)