Merge branch 'PHP-8.4'

* PHP-8.4: Fix GH-16292: Segmentation fault in ext/xmlreader/php_xmlreader.c:1282
php · Oct 8, 2024 · dd0ced3 · dd0ced3
2 parents c8194a1 + 1f84f5c
commit dd0ced3
Show file tree

Hide file tree

Showing 3 changed files with 34 additions and 2 deletions.
diff --git a/ext/dom/xml_common.h b/ext/dom/xml_common.h
@@ -60,7 +60,7 @@ PHP_DOM_EXPORT xmlNodePtr dom_object_get_node(dom_object *obj);
 	__intern = Z_LIBXML_NODE_P(__id); \
 	if (UNEXPECTED(__intern->node == NULL)) { \
 		php_error_docref(NULL, E_WARNING, "Couldn't fetch %s", \
-			ZSTR_VAL(__intern->std.ce->name));\
+			ZSTR_VAL(Z_OBJCE_P(__zv)->name));\
 		RETURN_NULL();\
 	} \
 	__ptr = (__prtype)__intern->node->node; \

diff --git a/ext/xmlreader/php_xmlreader.c b/ext/xmlreader/php_xmlreader.c
@@ -1279,7 +1279,13 @@ PHP_METHOD(XMLReader, expand)
 	}
 
 	if (basenode != NULL) {
-		NODE_GET_OBJ(node, basenode, xmlNodePtr, domobj);
+		/* Note: cannot use NODE_GET_OBJ here because of the wrong return type */
+		domobj = Z_LIBXML_NODE_P(basenode);
+		if (UNEXPECTED(domobj->node == NULL)) {
+			php_error_docref(NULL, E_WARNING, "Couldn't fetch %s", ZSTR_VAL(Z_OBJCE_P(basenode)->name));
+			RETURN_FALSE;
+		}
+		node = domobj->node->node;
 		docp = node->doc;
 	}
 

diff --git a/ext/xmlreader/tests/gh16292.phpt b/ext/xmlreader/tests/gh16292.phpt
@@ -0,0 +1,26 @@
+--TEST--
+GH-16292 (Segmentation fault in ext/xmlreader/php_xmlreader.c:1282)
+--EXTENSIONS--
+dom
+xmlreader
+--FILE--
+<?php
+
+$character_data = new DOMCharacterData();
+$xmlstring = '<?xml version="1.0" encoding="UTF-8"?>
+<books><book>new book</book></books>';
+$reader = new XMLReader();
+$reader->XML($xmlstring);
+while ($reader->read()) {
+    if ($reader->localName == "book") {
+        var_dump($reader->expand($character_data));
+    }
+}
+
+?>
+--EXPECTF--
+Warning: XMLReader::expand(): Couldn't fetch DOMCharacterData in %s on line %d
+bool(false)
+
+Warning: XMLReader::expand(): Couldn't fetch DOMCharacterData in %s on line %d
+bool(false)