diff options
| author | Christoph M. Becker <cmbecker69@gmx.de> | 2020-08-10 12:25:08 +0200 |
|---|---|---|
| committer | Christoph M. Becker <cmbecker69@gmx.de> | 2020-08-10 12:25:26 +0200 |
| commit | 2830c3ef52fd93f211fdaba5d78b5a462ccefdf7 (patch) | |
| tree | cac6905216f5ca2e035a1b3952cd2647e3178de1 | |
| parent | 2d087210ebb8adc06dcaca37b9d2dcb93ea2156c (diff) | |
| parent | 0af3f493121f8eb5f71051303c5ee1a42a81fc6f (diff) | |
| download | php-git-2830c3ef52fd93f211fdaba5d78b5a462ccefdf7.tar.gz | |
Merge branch 'PHP-7.3' into PHP-7.4
* PHP-7.3:
Fix #79922: Crash after multiple calls to xml_parser_free()
| -rw-r--r-- | NEWS | 3 | ||||
| -rw-r--r-- | ext/xml/tests/bug79922.phpt | 17 | ||||
| -rw-r--r-- | ext/xml/xml.c | 4 |
3 files changed, 22 insertions, 2 deletions
@@ -29,6 +29,9 @@ PHP NEWS . Fixed bug #79930 (array_merge_recursive() crashes when called with array with single reference). (Nikita) +- XML: + . Fixed bug #79922 (Crash after multiple calls to xml_parser_free()). (cmb) + 06 Aug 2020, PHP 7.4.9 - Apache: diff --git a/ext/xml/tests/bug79922.phpt b/ext/xml/tests/bug79922.phpt new file mode 100644 index 0000000000..e578a5d2c4 --- /dev/null +++ b/ext/xml/tests/bug79922.phpt @@ -0,0 +1,17 @@ +--TEST-- +Bug #79922 (Crash after multiple calls to xml_parser_free()) +--SKIPIF-- +<?php +if (!extension_loaded('xml')) die('skip xml extension not available'); +?> +--FILE-- +<?php +$c=xml_parser_create_ns(); +$a=xml_parser_free($c); +$a=xml_parser_free($c); +$c=0; +var_dump($a); +?> +--EXPECTF-- +Warning: xml_parser_free(): supplied resource is not a valid XML Parser resource in %s on line %d +bool(false) diff --git a/ext/xml/xml.c b/ext/xml/xml.c index fb60883226..af3431daa4 100644 --- a/ext/xml/xml.c +++ b/ext/xml/xml.c @@ -1157,7 +1157,7 @@ static void php_xml_parser_create_impl(INTERNAL_FUNCTION_PARAMETERS, int ns_supp XML_SetUserData(parser->parser, parser); RETVAL_RES(zend_register_resource(parser, le_xml_parser)); - ZVAL_COPY(&parser->index, return_value); + ZVAL_COPY_VALUE(&parser->index, return_value); } /* }}} */ @@ -1589,7 +1589,7 @@ PHP_FUNCTION(xml_parser_free) RETURN_FALSE; } - if (zend_list_delete(Z_RES(parser->index)) == FAILURE) { + if (zend_list_close(Z_RES(parser->index)) == FAILURE) { RETURN_FALSE; } |