Skip to content

Commit 1bda46e

Browse files
committed
Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3: Fix NEWS order Fix GH-19988: zend_string_init with NULL pointer in simplexml (UB)
2 parents a6b32bd + 190f427 commit 1bda46e

File tree

3 files changed

+24
-1
lines changed

3 files changed

+24
-1
lines changed

NEWS

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,10 @@ PHP NEWS
3232
(Arnaud)
3333
. Fixed bug GH-19831 (function JIT may not deref property value). (Arnaud)
3434

35+
- SimpleXML:
36+
. Fixed bug GH-19988 (zend_string_init with NULL pointer in simplexml (UB)).
37+
(nielsdos)
38+
3539
- Soap:
3640
. Fixed bug GH-19784 (SoapServer memory leak). (nielsdos)
3741

ext/simplexml/simplexml.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1629,7 +1629,7 @@ PHP_METHOD(SimpleXMLElement, getName)
16291629
node = php_sxe_get_first_node_non_destructive(sxe, node);
16301630
if (node) {
16311631
namelen = xmlStrlen(node->name);
1632-
RETURN_STRINGL((char*)node->name, namelen);
1632+
RETURN_STRINGL_FAST((const char *) node->name, namelen);
16331633
} else {
16341634
RETURN_EMPTY_STRING();
16351635
}

ext/xsl/tests/gh19988.phpt

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
--TEST--
2+
GH-19988 (zend_string_init with NULL pointer in simplexml (UB))
3+
--EXTENSIONS--
4+
simplexml
5+
xsl
6+
--CREDITS--
7+
YuanchengJiang
8+
--FILE--
9+
<?php
10+
$sxe = simplexml_load_file(__DIR__ . '/53965/collection.xml');
11+
$processor = new XSLTProcessor;
12+
$dom = new DOMDocument;
13+
$dom->load(__DIR__ . '/53965/collection.xsl');
14+
$processor->importStylesheet($dom);
15+
$result = $processor->transformToDoc($sxe, SimpleXMLElement::class);
16+
var_dump($result->getName());
17+
?>
18+
--EXPECT--
19+
string(0) ""

0 commit comments

Comments
 (0)