Skip to content

Commit 768e8b8

Browse files
committed
Merge branch 'PHP-8.0'
* PHP-8.0: Fix #73246: XMLReader: encoding length not checked
2 parents 54222a6 + 645815c commit 768e8b8

File tree

2 files changed

+26
-0
lines changed

2 files changed

+26
-0
lines changed

ext/xmlreader/php_xmlreader.c

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -860,6 +860,11 @@ PHP_METHOD(XMLReader, open)
860860
RETURN_THROWS();
861861
}
862862

863+
if (encoding && CHECK_NULL_PATH(encoding, encoding_len)) {
864+
php_error_docref(NULL, E_WARNING, "Encoding must not contain NUL bytes");
865+
RETURN_FALSE;
866+
}
867+
863868
valid_file = _xmlreader_get_valid_file_path(source, resolved_path, MAXPATHLEN );
864869

865870
if (valid_file) {
@@ -1035,6 +1040,11 @@ PHP_METHOD(XMLReader, XML)
10351040
RETURN_THROWS();
10361041
}
10371042

1043+
if (encoding && CHECK_NULL_PATH(encoding, encoding_len)) {
1044+
php_error_docref(NULL, E_WARNING, "Encoding must not contain NUL bytes");
1045+
RETURN_FALSE;
1046+
}
1047+
10381048
inputbfr = xmlParserInputBufferCreateMem(source, source_len, XML_CHAR_ENCODING_NONE);
10391049

10401050
if (inputbfr != NULL) {

ext/xmlreader/tests/bug73246.phpt

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
--TEST--
2+
Bug #73246 (XMLReader: encoding length not checked)
3+
--SKIPIF--
4+
<?php
5+
if (!extension_loaded("xmlreader")) die("skip xmlreader extension not available");
6+
?>
7+
--FILE--
8+
<?php
9+
$reader = new XMLReader();
10+
$reader->open(__FILE__, "UTF\0-8");
11+
$reader->XML('<?xml version="1.0"?><root/>', "UTF\0-8");
12+
?>
13+
--EXPECTF--
14+
Warning: XMLReader::open(): Encoding must not contain NUL bytes in %s on line %d
15+
16+
Warning: XMLReader::XML(): Encoding must not contain NUL bytes in %s on line %d

0 commit comments

Comments
 (0)