diff options
| author | Xinchen Hui <laruence@gmail.com> | 2017-07-21 18:16:54 +0800 |
|---|---|---|
| committer | Xinchen Hui <laruence@gmail.com> | 2017-07-21 18:16:54 +0800 |
| commit | 08177312fbacac234248c3f6fd60cdc912cb3cc4 (patch) | |
| tree | 3d7ea201e907df2ee599c73ac1cce969fd5cbf94 /ext/simplexml | |
| parent | 4b3ed311aae8ee4b6dbb26059b830d22431e9784 (diff) | |
| parent | 256ec5bebb04d9fdea55951d8bb26eed659adf66 (diff) | |
| download | php-git-08177312fbacac234248c3f6fd60cdc912cb3cc4.tar.gz | |
Merge branch 'PHP-7.0' into PHP-7.1
* PHP-7.0:
Fixed bug #74950 (nullpointer deref in simplexml_element_getDocNamespaces)
Diffstat (limited to 'ext/simplexml')
| -rw-r--r-- | ext/simplexml/simplexml.c | 12 | ||||
| -rw-r--r-- | ext/simplexml/tests/bug74950.phpt | 16 |
2 files changed, 22 insertions, 6 deletions
diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c index 7e5516dcdf..50413b12ac 100644 --- a/ext/simplexml/simplexml.c +++ b/ext/simplexml/simplexml.c @@ -2321,16 +2321,16 @@ SXE_METHOD(__construct) } if (ZEND_SIZE_T_INT_OVFL(data_len)) { - php_error_docref(NULL, E_WARNING, "Data is too long"); - RETURN_FALSE; + zend_throw_exception(zend_ce_exception, "Data is too long", 0); + return; } if (ZEND_SIZE_T_INT_OVFL(ns_len)) { - php_error_docref(NULL, E_WARNING, "Namespace is too long"); - RETURN_FALSE; + zend_throw_exception(zend_ce_exception, "Namespace is too long", 0); + return; } if (ZEND_LONG_EXCEEDS_INT(options)) { - php_error_docref(NULL, E_WARNING, "Invalid options"); - RETURN_FALSE; + zend_throw_exception(zend_ce_exception, "Invalid options", 0); + return; } docp = is_url ? xmlReadFile(data, NULL, (int)options) : xmlReadMemory(data, (int)data_len, NULL, NULL, (int)options); diff --git a/ext/simplexml/tests/bug74950.phpt b/ext/simplexml/tests/bug74950.phpt new file mode 100644 index 0000000000..f267a07a81 --- /dev/null +++ b/ext/simplexml/tests/bug74950.phpt @@ -0,0 +1,16 @@ +--TEST-- +Bug #74950 (null pointer deref in zim_simplexml_element_getDocNamespaces) +--SKIPIF-- +<?php +if (!extension_loaded("simplexml")) die("skip SimpleXML not available"); +?> +--FILE-- +<?php +$xml=new SimpleXMLElement(0,9000000000);var_dump($xml->getDocNamespaces())?> +?> +--EXPECTF-- +Fatal error: Uncaught Exception: Invalid options in %sbug74950.php:%d +Stack trace: +#0 %sbug74950.php(%d): SimpleXMLElement->__construct('0', 9000000000) +#1 {main} + thrown in %sbug74950.php on line %d |