diff options
| author | Scott MacVicar <scottmac@php.net> | 2011-05-13 05:54:34 +0000 |
|---|---|---|
| committer | Scott MacVicar <scottmac@php.net> | 2011-05-13 05:54:34 +0000 |
| commit | 2c7fb35b831c03827c68c25f91bc2e344c919626 (patch) | |
| tree | f63045f1b9fcc105be5df1c2a1fb1447a177b93b /ext/xmlreader/php_xmlreader.c | |
| parent | 194b48088cf0f0017f1b6b0b53203d8e0e5ef0b0 (diff) | |
| download | php-git-2c7fb35b831c03827c68c25f91bc2e344c919626.tar.gz | |
Fix use after free() in XMLReader::xml()
Diffstat (limited to 'ext/xmlreader/php_xmlreader.c')
| -rw-r--r-- | ext/xmlreader/php_xmlreader.c | 14 |
1 files changed, 11 insertions, 3 deletions
diff --git a/ext/xmlreader/php_xmlreader.c b/ext/xmlreader/php_xmlreader.c index 80ce3d7e3a..b9f6348c04 100644 --- a/ext/xmlreader/php_xmlreader.c +++ b/ext/xmlreader/php_xmlreader.c @@ -30,6 +30,7 @@ #ifdef HAVE_DOM #include "ext/dom/xml_common.h" #endif +#include <libxml/xmlreader.h> #include <libxml/uri.h> zend_class_entry *xmlreader_class_entry; @@ -1091,9 +1092,7 @@ PHP_METHOD(xmlreader, XML) uri = (char *) xmlCanonicPath((const xmlChar *) resolved_path); } reader = xmlNewTextReader(inputbfr, uri); - if (uri) { - xmlFree(uri); - } + if (reader != NULL) { #if LIBXML_VERSION >= 20628 ret = xmlTextReaderSetup(reader, NULL, uri, encoding, options); @@ -1107,11 +1106,20 @@ PHP_METHOD(xmlreader, XML) } intern->input = inputbfr; intern->ptr = reader; + + if (uri) { + xmlFree(uri); + } + return; } } } + if (uri) { + xmlFree(uri); + } + if (inputbfr) { xmlFreeParserInputBuffer(inputbfr); } |