Skip to content

Instantly share code, notes, and snippets.

@cmb69

cmb69/.diff Secret

Created Apr 21, 2021
Embed
What would you like to do?
Fix for PHP bug #73246
ext/xmlreader/php_xmlreader.c | 10 ++++++++++
ext/xmlreader/tests/bug73246.phpt | 16 ++++++++++++++++
2 files changed, 26 insertions(+)
diff --git a/ext/xmlreader/php_xmlreader.c b/ext/xmlreader/php_xmlreader.c
index 20960d96d5..06f569949c 100644
--- a/ext/xmlreader/php_xmlreader.c
+++ b/ext/xmlreader/php_xmlreader.c
@@ -873,6 +873,11 @@ PHP_METHOD(xmlreader, open)
RETURN_FALSE;
}
+ if (encoding && CHECK_NULL_PATH(encoding, encoding_len)) {
+ php_error_docref(NULL, E_WARNING, "Encoding must not contain NUL bytes");
+ RETURN_FALSE;
+ }
+
valid_file = _xmlreader_get_valid_file_path(source, resolved_path, MAXPATHLEN );
if (valid_file) {
@@ -1055,6 +1060,11 @@ PHP_METHOD(xmlreader, XML)
RETURN_FALSE;
}
+ if (encoding && CHECK_NULL_PATH(encoding, encoding_len)) {
+ php_error_docref(NULL, E_WARNING, "Encoding must not contain NUL bytes");
+ RETURN_FALSE;
+ }
+
inputbfr = xmlParserInputBufferCreateMem(source, source_len, XML_CHAR_ENCODING_NONE);
if (inputbfr != NULL) {
diff --git a/ext/xmlreader/tests/bug73246.phpt b/ext/xmlreader/tests/bug73246.phpt
new file mode 100644
index 0000000000..5768d3e8de
--- /dev/null
+++ b/ext/xmlreader/tests/bug73246.phpt
@@ -0,0 +1,16 @@
+--TEST--
+Bug #73246 (XMLReader: encoding length not checked)
+--SKIPIF--
+<?php
+if (!extension_loaded("xmlreader")) die("skip xmlreader extension not available");
+?>
+--FILE--
+<?php
+$reader = new XMLReader();
+$reader->open(__FILE__, "UTF\0-8");
+$reader->XML('<?xml version="1.0"?><root/>', "UTF\0-8");
+?>
+--EXPECTF--
+Warning: XMLReader::open(): Encoding must not contain NUL bytes in %s on line %d
+
+Warning: XMLReader::XML(): Encoding must not contain NUL bytes in %s on line %d
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment