Skip to content

Commit 6a07400

Browse files
committed
Merge branch 'PHP-8.3'
* PHP-8.3: Fix GH-15551: Segmentation fault (access null pointer) in ext/dom/xml_common.h
2 parents d32b97a + 8a00faa commit 6a07400

File tree

3 files changed

+22
-2
lines changed

3 files changed

+22
-2
lines changed

NEWS

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,10 @@ PHP NEWS
1919
. Fixed bug GH-13773 (DatePeriod not taking into account microseconds for end
2020
date). (Mark Bennewitz, Derick)
2121

22+
- DOM:
23+
. Fixed bug GH-15551 (Segmentation fault (access null pointer) in
24+
ext/dom/xml_common.h). (nielsdos)
25+
2226
- MySQLnd:
2327
. Fixed bug GH-15432 (Heap corruption when querying a vector). (cmb,
2428
Kamil Tekiela)

ext/dom/dom_iterators.c

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -164,13 +164,15 @@ static void php_dom_iterator_move_forward(zend_object_iterator *iter) /* {{{ */
164164
xmlNodePtr curnode = NULL;
165165

166166
php_dom_iterator *iterator = (php_dom_iterator *)iter;
167+
if (Z_ISUNDEF(iterator->curobj)) {
168+
return;
169+
}
167170

171+
dom_object *intern = Z_DOMOBJ_P(&iterator->curobj);
168172
zval *object = &iterator->intern.data;
169173
dom_object *nnmap = Z_DOMOBJ_P(object);
170174
dom_nnodemap_object *objmap = nnmap->ptr;
171175

172-
dom_object *intern = Z_DOMOBJ_P(&iterator->curobj);
173-
174176
if (intern != NULL && intern->ptr != NULL) {
175177
if (objmap->nodetype != XML_ENTITY_NODE &&
176178
objmap->nodetype != XML_NOTATION_NODE) {

ext/dom/tests/gh15551.phpt

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
--TEST--
2+
GH-15551 (Segmentation fault (access null pointer) in ext/dom/xml_common.h)
3+
--EXTENSIONS--
4+
dom
5+
--FILE--
6+
<?php
7+
$fragment = new DOMDocumentFragment();
8+
$nodes = $fragment->childNodes;
9+
$iter = $nodes->getIterator();
10+
$iter->next();
11+
var_dump($iter->valid());
12+
?>
13+
--EXPECT--
14+
bool(false)

0 commit comments

Comments
 (0)