diff options
| -rw-r--r-- | ext/libxml/libxml.c | 4 | ||||
| -rw-r--r-- | ext/xmlwriter/tests/bug79029.phpt | 32 | ||||
| -rw-r--r-- | ext/xmlwriter/tests/bug79029_1.phpt | 13 |
3 files changed, 36 insertions, 13 deletions
diff --git a/ext/libxml/libxml.c b/ext/libxml/libxml.c index 9c6a51f5f8..e330022eeb 100644 --- a/ext/libxml/libxml.c +++ b/ext/libxml/libxml.c @@ -327,6 +327,10 @@ static void *php_libxml_streams_IO_open_wrapper(const char *filename, const char context = php_stream_context_from_zval(Z_ISUNDEF(LIBXML(stream_context))? NULL : &LIBXML(stream_context), 0); ret_val = php_stream_open_wrapper_ex(path_to_open, (char *)mode, REPORT_ERRORS, NULL, context); + if (ret_val) { + /* Prevent from closing this by fclose() */ + ((php_stream*)ret_val)->flags |= PHP_STREAM_FLAG_NO_FCLOSE; + } if (isescaped) { xmlFree(resolved_path); } diff --git a/ext/xmlwriter/tests/bug79029.phpt b/ext/xmlwriter/tests/bug79029.phpt new file mode 100644 index 0000000000..f329b62756 --- /dev/null +++ b/ext/xmlwriter/tests/bug79029.phpt @@ -0,0 +1,32 @@ +--TEST-- +#79029 (Use After Free's in XMLReader / XMLWriter) +--SKIPIF-- +<?php if (!extension_loaded("xmlwriter")) print "skip"; ?> +--FILE-- +<?php +$x = array( new XMLWriter() ); +$x[0]->openUri("bug79029.txt"); +$x[0]->startComment(); +@unlink("bug79029.txt"); + +$x = new XMLWriter(); +$x->openUri("bug79029.txt"); +fclose(@end(get_resources())); +@unlink("bug79029.txt"); + +file_put_contents("bug79029.txt", "a"); +$x = new XMLReader(); +$x->open("bug79029.txt"); +fclose(@end(get_resources())); +@unlink("bug79029.txt"); +?> +okey +--CLEAN-- +<?php +@unlink("bug79029.txt"); +?> +--EXPECTF-- +Warning: fclose(): %d is not a valid stream resource in %sbug79029.php on line %d + +Warning: fclose(): %d is not a valid stream resource in %sbug79029.php on line %d +okey diff --git a/ext/xmlwriter/tests/bug79029_1.phpt b/ext/xmlwriter/tests/bug79029_1.phpt deleted file mode 100644 index c91295c167..0000000000 --- a/ext/xmlwriter/tests/bug79029_1.phpt +++ /dev/null @@ -1,13 +0,0 @@ ---TEST-- -#79029 (Use After Free's in XMLReader / XMLWriter) ---SKIPIF-- -<?php if (!extension_loaded("xmlwriter")) print "skip"; ?> ---FILE-- -<?php -$x = array( new XMLWriter() ); -$x[0]->openUri("a"); -$x[0]->startComment(); -?> -okey ---EXPECT-- -okey |