diff options
| author | Xinchen Hui <laruence@gmail.com> | 2019-12-25 12:43:44 +0800 |
|---|---|---|
| committer | Xinchen Hui <laruence@gmail.com> | 2019-12-25 12:43:44 +0800 |
| commit | b5e004379647bd1ebb75eb2eac8826fb6abdd3d8 (patch) | |
| tree | 2ea9ab1e0d7458ea01b00e4cc32b795cc0380e5c /ext | |
| parent | f09b958e90afc0458a30a2c775abc2525827e7ac (diff) | |
| download | php-git-b5e004379647bd1ebb75eb2eac8826fb6abdd3d8.tar.gz | |
Partial fix for bug #79029
Diffstat (limited to 'ext')
| -rw-r--r-- | ext/xmlwriter/php_xmlwriter.c | 16 | ||||
| -rw-r--r-- | ext/xmlwriter/tests/bug79029_1.phpt | 13 |
2 files changed, 22 insertions, 7 deletions
diff --git a/ext/xmlwriter/php_xmlwriter.c b/ext/xmlwriter/php_xmlwriter.c index 2fa4e32854..a4f1df3917 100644 --- a/ext/xmlwriter/php_xmlwriter.c +++ b/ext/xmlwriter/php_xmlwriter.c @@ -83,13 +83,15 @@ typedef int (*xmlwriter_read_int_t)(xmlTextWriterPtr writer); static void xmlwriter_free_resource_ptr(xmlwriter_object *intern) { if (intern) { - if (intern->ptr) { - xmlFreeTextWriter(intern->ptr); - intern->ptr = NULL; - } - if (intern->output) { - xmlBufferFree(intern->output); - intern->output = NULL; + if (EG(active)) { + if (intern->ptr) { + xmlFreeTextWriter(intern->ptr); + intern->ptr = NULL; + } + if (intern->output) { + xmlBufferFree(intern->output); + intern->output = NULL; + } } efree(intern); } diff --git a/ext/xmlwriter/tests/bug79029_1.phpt b/ext/xmlwriter/tests/bug79029_1.phpt new file mode 100644 index 0000000000..c91295c167 --- /dev/null +++ b/ext/xmlwriter/tests/bug79029_1.phpt @@ -0,0 +1,13 @@ +--TEST-- +#79029 (Use After Free's in XMLReader / XMLWriter) +--SKIPIF-- +<?php if (!extension_loaded("xmlwriter")) print "skip"; ?> +--FILE-- +<?php +$x = array( new XMLWriter() ); +$x[0]->openUri("a"); +$x[0]->startComment(); +?> +okey +--EXPECT-- +okey |