Skip to content

Commit 31b17b4

Browse files
nielsdosnielsdos
committed
Implement request #68325: parse huge option for xml_parser_create
1 parent 186a07f commit 31b17b4

6 files changed

+158
-13
lines changed

‎ext/xml/php_xml.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,8 @@ enum php_xml_option {
4343
PHP_XML_OPTION_CASE_FOLDING = 1,
4444
PHP_XML_OPTION_TARGET_ENCODING,
4545
PHP_XML_OPTION_SKIP_TAGSTART,
46-
PHP_XML_OPTION_SKIP_WHITE
46+
PHP_XML_OPTION_SKIP_WHITE,
47+
PHP_XML_OPTION_PARSE_HUGE,
4748
};
4849

4950
#ifdef LIBXML_EXPAT_COMPAT

‎ext/xml/tests/XML_OPTION_PARSE_HUGE.phpt

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
--TEST--
2+
Request #68325 (XML_OPTION_PARSE_HUGE cannot be set for xml_parser_create)
3+
--EXTENSIONS--
4+
xml
5+
--FILE--
6+
<?php
7+
8+
function logName(string $str) {
9+
if (strlen($str) > 20) {
10+
echo substr($str, 0, 20) . "...\n";
11+
} else {
12+
echo $str . "\n";
13+
}
14+
}
15+
16+
function createParser(bool $huge) {
17+
$parser = xml_parser_create();
18+
echo "old option value: "; var_dump(xml_parser_get_option($parser, XML_OPTION_PARSE_HUGE));
19+
xml_parser_set_option($parser, XML_OPTION_PARSE_HUGE, $huge);
20+
echo "new option value: "; var_dump(xml_parser_get_option($parser, XML_OPTION_PARSE_HUGE));
21+
xml_set_element_handler($parser, function($parser, $data) {
22+
echo "open: ";
23+
logName($data);
24+
}, function($parser, $data) {
25+
});
26+
return $parser;
27+
}
28+
29+
// Construct XML that is too large to parse without XML_OPTION_PARSE_HUGE
30+
$long_text = str_repeat("A", 1000 * 1000 * 5 /* 5 MiB */);
31+
$long_xml_head = "<?xml version=\"1.0\"?><container><$long_text/><$long_text/><second>foo</second>";
32+
$long_xml_tail = "</container>";
33+
34+
echo "--- Parse using xml_parse (failure) ---\n";
35+
$parser = createParser(false);
36+
$ret = xml_parse($parser, $long_xml_head, true);
37+
echo "ret = $ret (", xml_error_string(xml_get_error_code($parser)), ")\n";
38+
39+
echo "--- Parse using xml_parse (success) ---\n";
40+
$parser = createParser(true);
41+
$ret = xml_parse($parser, $long_xml_head, false);
42+
echo "ret = $ret (", xml_error_string(xml_get_error_code($parser)), ")\n";
43+
xml_parser_set_option($parser, XML_OPTION_PARSE_HUGE, false); // Switch between parsing shouldn't matter
44+
$ret = xml_parse($parser, $long_xml_tail, true);
45+
echo "ret = $ret (", xml_error_string(xml_get_error_code($parser)), ")\n";
46+
47+
echo "--- Parse using xml_parse_into_struct (failure) ---\n";
48+
$parser = createParser(false);
49+
$ret = xml_parse_into_struct($parser, $long_xml_head, $values, $index);
50+
echo "ret = $ret (", xml_error_string(xml_get_error_code($parser)), ")\n";
51+
52+
echo "--- Parse using xml_parse_into_struct (success) ---\n";
53+
$parser = createParser(true);
54+
$ret = xml_parse_into_struct($parser, $long_xml_head . $long_xml_tail, $values, $index);
55+
var_dump(count($values), count($index)); // Not printing out the raw array because the long string will be contained in them as key
56+
echo "ret = $ret (", xml_error_string(xml_get_error_code($parser)), ")\n";
57+
58+
?>
59+
--EXPECT--
60+
--- Parse using xml_parse (failure) ---
61+
old option value: bool(false)
62+
new option value: bool(false)
63+
open: CONTAINER
64+
ret = 0 (XML_ERR_NAME_REQUIRED)
65+
--- Parse using xml_parse (success) ---
66+
old option value: bool(false)
67+
new option value: bool(true)
68+
open: CONTAINER
69+
open: AAAAAAAAAAAAAAAAAAAA...
70+
open: AAAAAAAAAAAAAAAAAAAA...
71+
open: SECOND
72+
ret = 1 (No error)
73+
ret = 1 (No error)
74+
--- Parse using xml_parse_into_struct (failure) ---
75+
old option value: bool(false)
76+
new option value: bool(false)
77+
open: CONTAINER
78+
ret = 0 (XML_ERR_NAME_REQUIRED)
79+
--- Parse using xml_parse_into_struct (success) ---
80+
old option value: bool(false)
81+
new option value: bool(true)
82+
open: CONTAINER
83+
open: AAAAAAAAAAAAAAAAAAAA...
84+
open: AAAAAAAAAAAAAAAAAAAA...
85+
open: SECOND
86+
int(5)
87+
int(3)
88+
ret = 1 (No error)

‎ext/xml/tests/XML_OPTION_PARSE_HUGE_during_parsing.phpt

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
--TEST--
2+
Request #68325 (XML_OPTION_PARSE_HUGE cannot be set for xml_parser_create - setting during parsing)
3+
--EXTENSIONS--
4+
xml
5+
--FILE--
6+
<?php
7+
8+
$parser = xml_parser_create();
9+
xml_set_element_handler($parser, function($parser, $data) {
10+
xml_parser_set_option($parser, XML_OPTION_PARSE_HUGE, true);
11+
}, function($parser, $data) {
12+
});
13+
xml_parse($parser, "<foo/>", true);
14+
15+
?>
16+
--EXPECTF--
17+
Fatal error: Uncaught Error: Cannot change option XML_OPTION_PARSE_HUGE while parsing in %s:%d
18+
Stack trace:
19+
#0 %s(%d): xml_parser_set_option(Object(XMLParser), 5, true)
20+
#1 [internal function]: {closure}(Object(XMLParser), 'FOO', Array)
21+
#2 %s(%d): xml_parse(Object(XMLParser), '<foo/>', true)
22+
#3 {main}
23+
thrown in %s on line %d

‎ext/xml/xml.c

Lines changed: 38 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -108,6 +108,7 @@ typedef struct {
108108
int lastwasopen;
109109
int skipwhite;
110110
int isparsing;
111+
bool parsehuge;
111112

112113
XML_Char *baseURI;
113114

@@ -283,6 +284,28 @@ PHP_MINFO_FUNCTION(xml)
283284

284285
/* {{{ extension-internal functions */
285286

287+
static int xml_parse_helper(xml_parser *parser, const char *data, size_t data_len, bool is_final)
288+
{
289+
ZEND_ASSERT(!parser->isparsing);
290+
291+
/* libxml2 specific options */
292+
#if LIBXML_EXPAT_COMPAT
293+
/* See xmlInitSAXParserCtxt() and xmlCtxtUseOptions() */
294+
if (parser->parsehuge) {
295+
parser->parser->parser->options |= XML_PARSE_HUGE;
296+
xmlDictSetLimit(parser->parser->parser->dict, 0);
297+
} else {
298+
parser->parser->parser->options &= ~XML_PARSE_HUGE;
299+
xmlDictSetLimit(parser->parser->parser->dict, XML_MAX_DICTIONARY_LIMIT);
300+
}
301+
#endif
302+
303+
parser->isparsing = 1;
304+
int ret = XML_Parse(parser->parser, (const XML_Char *) data, data_len, is_final);
305+
parser->isparsing = 0;
306+
return ret;
307+
}
308+
286309
static void _xml_xmlchar_zval(const XML_Char *s, int len, const XML_Char *encoding, zval *ret)
287310
{
288311
if (s == NULL) {
@@ -1011,6 +1034,7 @@ static void php_xml_parser_create_impl(INTERNAL_FUNCTION_PARAMETERS, int ns_supp
10111034
parser->target_encoding = encoding;
10121035
parser->case_folding = 1;
10131036
parser->isparsing = 0;
1037+
parser->parsehuge = false; /* It's the default for BC & DoS protection */
10141038

10151039
XML_SetUserData(parser->parser, parser);
10161040
ZVAL_COPY_VALUE(&parser->index, return_value);
@@ -1220,7 +1244,6 @@ PHP_FUNCTION(xml_parse)
12201244
zval *pind;
12211245
char *data;
12221246
size_t data_len;
1223-
int ret;
12241247
bool isFinal = 0;
12251248

12261249
if (zend_parse_parameters(ZEND_NUM_ARGS(), "Os|b", &pind, xml_parser_ce, &data, &data_len, &isFinal) == FAILURE) {
@@ -1232,10 +1255,7 @@ PHP_FUNCTION(xml_parse)
12321255
zend_throw_error(NULL, "Parser must not be called recursively");
12331256
RETURN_THROWS();
12341257
}
1235-
parser->isparsing = 1;
1236-
ret = XML_Parse(parser->parser, (XML_Char*)data, data_len, isFinal);
1237-
parser->isparsing = 0;
1238-
RETVAL_LONG(ret);
1258+
RETURN_LONG(xml_parse_helper(parser, data, data_len, isFinal));
12391259
}
12401260

12411261
/* }}} */
@@ -1247,7 +1267,6 @@ PHP_FUNCTION(xml_parse_into_struct)
12471267
zval *pind, *xdata, *info = NULL;
12481268
char *data;
12491269
size_t data_len;
1250-
int ret;
12511270

12521271
if (zend_parse_parameters(ZEND_NUM_ARGS(), "Osz|z", &pind, xml_parser_ce, &data, &data_len, &xdata, &info) == FAILURE) {
12531272
RETURN_THROWS();
@@ -1283,11 +1302,7 @@ PHP_FUNCTION(xml_parse_into_struct)
12831302
php_error_docref(NULL, E_WARNING, "Parser must not be called recursively");
12841303
RETURN_FALSE;
12851304
}
1286-
parser->isparsing = 1;
1287-
ret = XML_Parse(parser->parser, (XML_Char*)data, data_len, 1);
1288-
parser->isparsing = 0;
1289-
1290-
RETVAL_LONG(ret);
1305+
RETURN_LONG(xml_parse_helper(parser, data, data_len, true));
12911306
}
12921307
/* }}} */
12931308

@@ -1416,6 +1431,15 @@ PHP_FUNCTION(xml_parser_set_option)
14161431
case PHP_XML_OPTION_SKIP_WHITE:
14171432
parser->skipwhite = zend_is_true(value);
14181433
break;
1434+
/* Boolean option */
1435+
case PHP_XML_OPTION_PARSE_HUGE:
1436+
/* Prevent wreaking havock to the parser internals during parsing */
1437+
if (UNEXPECTED(parser->isparsing)) {
1438+
zend_throw_error(NULL, "Cannot change option XML_OPTION_PARSE_HUGE while parsing");
1439+
RETURN_THROWS();
1440+
}
1441+
parser->parsehuge = zend_is_true(value);
1442+
break;
14191443
/* Integer option */
14201444
case PHP_XML_OPTION_SKIP_TAGSTART:
14211445
/* The tag start offset is stored in an int */
@@ -1477,6 +1501,9 @@ PHP_FUNCTION(xml_parser_get_option)
14771501
case PHP_XML_OPTION_SKIP_WHITE:
14781502
RETURN_BOOL(parser->skipwhite);
14791503
break;
1504+
case PHP_XML_OPTION_PARSE_HUGE:
1505+
RETURN_BOOL(parser->parsehuge);
1506+
break;
14801507
case PHP_XML_OPTION_TARGET_ENCODING:
14811508
RETURN_STRING((char *)parser->target_encoding);
14821509
break;

‎ext/xml/xml.stub.php

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -133,6 +133,11 @@
133133
* @cvalue PHP_XML_OPTION_SKIP_WHITE
134134
*/
135135
const XML_OPTION_SKIP_WHITE = UNKNOWN;
136+
/**
137+
* @var int
138+
* @cvalue PHP_XML_OPTION_PARSE_HUGE
139+
*/
140+
const XML_OPTION_PARSE_HUGE = UNKNOWN;
136141

137142
/**
138143
* @var string

‎ext/xml/xml_arginfo.h

Lines changed: 2 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)