Skip to content

Commit b8a1041

Browse files
nielsdosnielsdos
committed
Fix reference access in dimensions for DOMNodeList and DOMNodeMap
Closes GH-13511.
1 parent f732ab8 commit b8a1041

File tree

4 files changed

+102
-25
lines changed

4 files changed

+102
-25
lines changed

‎NEWS

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,10 @@ PHP NEWS
88
- Curl:
99
. Fix failing tests due to string changes in libcurl 8.6.0. (Ayesh)
1010

11+
- DOM:
12+
. Fix reference access in dimensions for DOMNodeList and DOMNodeMap.
13+
(nielsdos)
14+
1115
- Fileinfo:
1216
. Fixed bug GH-13344 (finfo::buffer(): Failed identify data 0:(null),
1317
backport). (nielsdos)

‎ext/dom/php_dom.c

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1643,6 +1643,8 @@ static zval *dom_nodelist_read_dimension(zend_object *object, zval *offset, int
16431643
return NULL;
16441644
}
16451645

1646+
ZVAL_DEREF(offset);
1647+
16461648
zend_long lval;
16471649
if (dom_nodemap_or_nodelist_process_offset_as_named(offset, &lval)) {
16481650
/* does not support named lookup */
@@ -1656,6 +1658,8 @@ static zval *dom_nodelist_read_dimension(zend_object *object, zval *offset, int
16561658

16571659
static int dom_nodelist_has_dimension(zend_object *object, zval *member, int check_empty)
16581660
{
1661+
ZVAL_DEREF(member);
1662+
16591663
zend_long offset;
16601664
if (dom_nodemap_or_nodelist_process_offset_as_named(member, &offset)) {
16611665
/* does not support named lookup */
@@ -1672,6 +1676,8 @@ static zval *dom_nodemap_read_dimension(zend_object *object, zval *offset, int t
16721676
return NULL;
16731677
}
16741678

1679+
ZVAL_DEREF(offset);
1680+
16751681
zend_long lval;
16761682
if (dom_nodemap_or_nodelist_process_offset_as_named(offset, &lval)) {
16771683
/* exceptional case, switch to named lookup */
@@ -1691,6 +1697,8 @@ static zval *dom_nodemap_read_dimension(zend_object *object, zval *offset, int t
16911697

16921698
static int dom_nodemap_has_dimension(zend_object *object, zval *member, int check_empty)
16931699
{
1700+
ZVAL_DEREF(member);
1701+
16941702
zend_long offset;
16951703
if (dom_nodemap_or_nodelist_process_offset_as_named(member, &offset)) {
16961704
/* exceptional case, switch to named lookup */

‎ext/dom/tests/DOMNamedNodeMap_string_references.phpt

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
--TEST--
2+
DOMNamedNodeMap string references
3+
--EXTENSIONS--
4+
dom
5+
--FILE--
6+
<?php
7+
8+
$dom = new DOMDocument;
9+
$dom->loadXML('<a href="hi" foo="bar"/>');
10+
11+
$attributes = $dom->documentElement->attributes;
12+
13+
var_dump(isset($attributes['href']), $attributes['href']->value);
14+
15+
var_dump(isset($attributes['foo']), $attributes['foo']->value);
16+
17+
$str = 'href';
18+
$ref =& $str;
19+
var_dump(isset($attributes[$ref]), $attributes[$ref]->value);
20+
21+
$str = 'foo';
22+
$ref =& $str;
23+
var_dump(isset($attributes[$ref]), $attributes[$ref]->value);
24+
25+
$str = 'this does not exist';
26+
$ref =& $str;
27+
var_dump(isset($attributes[$ref]), $attributes[$ref]);
28+
29+
$str = '0';
30+
$ref =& $str;
31+
var_dump(isset($attributes[$ref]), $attributes[$ref]->value);
32+
33+
$str = '1';
34+
$ref =& $str;
35+
var_dump(isset($attributes[$ref]), $attributes[$ref]->value);
36+
37+
$int = 0;
38+
$ref =& $int;
39+
var_dump(isset($attributes[$ref]), $attributes[$ref]->value);
40+
41+
$int = 1;
42+
$ref =& $int;
43+
var_dump(isset($attributes[$ref]), $attributes[$ref]->value);
44+
45+
?>
46+
--EXPECT--
47+
bool(true)
48+
string(2) "hi"
49+
bool(true)
50+
string(3) "bar"
51+
bool(true)
52+
string(2) "hi"
53+
bool(true)
54+
string(3) "bar"
55+
bool(false)
56+
NULL
57+
bool(true)
58+
string(2) "hi"
59+
bool(true)
60+
string(3) "bar"
61+
bool(true)
62+
string(2) "hi"
63+
bool(true)
64+
string(3) "bar"

‎ext/dom/tests/bug67949.phpt

Lines changed: 26 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ dom
55
--FILE--
66
<?php
77

8+
// Note: non-numeric string accesses fail on NodeLists (as per spec).
9+
810
$html = <<<HTML
911
<div>data</div>
1012
<a href="test">hello world</a>
@@ -14,57 +16,56 @@ $doc->loadHTML($html);
1416

1517
$nodes = $doc->getElementsByTagName('div');
1618

17-
echo "testing has_dimension\n";
19+
echo "--- testing has_dimension ---\n";
1820
var_dump(isset($nodes[0]));
1921
var_dump(isset($nodes[1]));
2022
var_dump(isset($nodes[-1]));
2123

22-
echo "testing property access\n";
24+
echo "--- testing property access ---\n";
2325
var_dump($nodes[0]->textContent);
2426
var_dump($nodes[1]->textContent);
2527

26-
echo "testing offset not a long\n";
28+
echo "--- testing offset not a long: array ---\n";
2729
$offset = ['test'];
2830
var_dump($offset);
2931
var_dump(isset($nodes[$offset]), $nodes[$offset]->textContent);
30-
var_dump($offset);
3132

32-
$something = 'test';
33+
echo "--- testing offset not a long: Reference to string ---\n";
34+
$something = 'href';
3335
$offset = &$something;
3436

3537
var_dump($offset);
3638
var_dump(isset($nodes[$offset]), $nodes[$offset]->textContent);
37-
var_dump($offset);
3839

40+
echo "--- testing offset not a long: string ---\n";
3941
$offset = 'test';
4042
var_dump($offset);
4143
var_dump(isset($nodes[$offset]), $nodes[$offset]->textContent);
42-
var_dump($offset);
4344

44-
echo "testing read_dimension with null offset\n";
45+
echo "--- testing read_dimension with null offset ---\n";
4546
try {
4647
var_dump($nodes[][] = 1);
4748
} catch (Error $e) {
4849
echo $e->getMessage(), "\n";
4950
}
5051

51-
echo "testing attribute access\n";
52+
echo "--- testing attribute access ---\n";
5253
$anchor = $doc->getElementsByTagName('a')[0];
5354
var_dump($anchor->attributes[0]->name);
5455

5556
echo "==DONE==\n";
5657
?>
5758
--EXPECTF--
58-
testing has_dimension
59+
--- testing has_dimension ---
5960
bool(true)
6061
bool(false)
6162
bool(false)
62-
testing property access
63+
--- testing property access ---
6364
string(4) "data"
6465

6566
Warning: Attempt to read property "textContent" on null in %s on line %d
6667
NULL
67-
testing offset not a long
68+
--- testing offset not a long: array ---
6869
array(1) {
6970
[0]=>
7071
string(4) "test"
@@ -73,20 +74,20 @@ array(1) {
7374
Warning: Attempt to read property "textContent" on null in %s on line %d
7475
bool(false)
7576
NULL
76-
array(1) {
77-
[0]=>
78-
string(4) "test"
79-
}
80-
string(4) "test"
81-
bool(true)
82-
string(4) "data"
83-
string(4) "test"
84-
string(4) "test"
85-
bool(true)
86-
string(4) "data"
77+
--- testing offset not a long: Reference to string ---
78+
string(4) "href"
79+
80+
Warning: Attempt to read property "textContent" on null in %s on line %d
81+
bool(false)
82+
NULL
83+
--- testing offset not a long: string ---
8784
string(4) "test"
88-
testing read_dimension with null offset
85+
86+
Warning: Attempt to read property "textContent" on null in %s on line %d
87+
bool(false)
88+
NULL
89+
--- testing read_dimension with null offset ---
8990
Cannot access DOMNodeList without offset
90-
testing attribute access
91+
--- testing attribute access ---
9192
string(4) "href"
9293
==DONE==

0 commit comments

Comments
 (0)