diff options
| author | Xinchen Hui <laruence@gmail.com> | 2019-12-25 13:14:08 +0800 |
|---|---|---|
| committer | Xinchen Hui <laruence@gmail.com> | 2019-12-25 13:14:08 +0800 |
| commit | d8ad2f4695ebd6dc2d4e668d9baeac1c071791a6 (patch) | |
| tree | bfe6bbfb1c08ad458a295d0b2c72e47e302b3614 /ext | |
| parent | b5e004379647bd1ebb75eb2eac8826fb6abdd3d8 (diff) | |
| download | php-git-d8ad2f4695ebd6dc2d4e668d9baeac1c071791a6.tar.gz | |
Fixed bug #79029 (Use After Free's in XMLReader / XMLWriter)
Diffstat (limited to 'ext')
| -rw-r--r-- | ext/libxml/libxml.c | 2 | ||||
| -rw-r--r-- | ext/xmlwriter/tests/bug79029.phpt | 32 | ||||
| -rw-r--r-- | ext/xmlwriter/tests/bug79029_1.phpt | 13 |
3 files changed, 34 insertions, 13 deletions
diff --git a/ext/libxml/libxml.c b/ext/libxml/libxml.c index efccf0a407..837cc7ad98 100644 --- a/ext/libxml/libxml.c +++ b/ext/libxml/libxml.c @@ -355,6 +355,8 @@ static void *php_libxml_streams_IO_open_wrapper(const char *filename, const char context = php_stream_context_from_zval(Z_ISUNDEF(LIBXML(stream_context))? NULL : &LIBXML(stream_context), 0); ret_val = php_stream_open_wrapper_ex(path_to_open, (char *)mode, REPORT_ERRORS, NULL, context); + /* Prevent from closing this by fclose() */ + ((php_stream*)ret_val)->flags |= PHP_STREAM_FLAG_NO_FCLOSE; if (isescaped) { xmlFree(resolved_path); } diff --git a/ext/xmlwriter/tests/bug79029.phpt b/ext/xmlwriter/tests/bug79029.phpt new file mode 100644 index 0000000000..f329b62756 --- /dev/null +++ b/ext/xmlwriter/tests/bug79029.phpt @@ -0,0 +1,32 @@ +--TEST-- +#79029 (Use After Free's in XMLReader / XMLWriter) +--SKIPIF-- +<?php if (!extension_loaded("xmlwriter")) print "skip"; ?> +--FILE-- +<?php +$x = array( new XMLWriter() ); +$x[0]->openUri("bug79029.txt"); +$x[0]->startComment(); +@unlink("bug79029.txt"); + +$x = new XMLWriter(); +$x->openUri("bug79029.txt"); +fclose(@end(get_resources())); +@unlink("bug79029.txt"); + +file_put_contents("bug79029.txt", "a"); +$x = new XMLReader(); +$x->open("bug79029.txt"); +fclose(@end(get_resources())); +@unlink("bug79029.txt"); +?> +okey +--CLEAN-- +<?php +@unlink("bug79029.txt"); +?> +--EXPECTF-- +Warning: fclose(): %d is not a valid stream resource in %sbug79029.php on line %d + +Warning: fclose(): %d is not a valid stream resource in %sbug79029.php on line %d +okey diff --git a/ext/xmlwriter/tests/bug79029_1.phpt b/ext/xmlwriter/tests/bug79029_1.phpt deleted file mode 100644 index c91295c167..0000000000 --- a/ext/xmlwriter/tests/bug79029_1.phpt +++ /dev/null @@ -1,13 +0,0 @@ ---TEST-- -#79029 (Use After Free's in XMLReader / XMLWriter) ---SKIPIF-- -<?php if (!extension_loaded("xmlwriter")) print "skip"; ?> ---FILE-- -<?php -$x = array( new XMLWriter() ); -$x[0]->openUri("a"); -$x[0]->startComment(); -?> -okey ---EXPECT-- -okey |