Fixed bug #79029 (Use After Free's in XMLReader / XMLWriter).

We backport the fix PHP 7.3, since this branch is affected as well.

(cherry picked from commit b5e004379647bd1ebb75eb2eac8826fb6abdd3d8)
(cherry picked from commit e36daa6927c05d2e687bb77495ef206cde118b33)
(cherry picked from commit 2704ee6844c03348de9d15e74646d09007ef0f7c)

diff --git a/NEWS b/NEWS
index 5f70bd1ae030f4e83d68768baac92880c84886fe..b11b87830a9d2748e66c14b4556c61b47e712f34 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -17,6 +17,9 @@ PHP                                                                        NEWS
   . Fixed bug #78923 (Artifacts when convoluting image with transparency).
     (wilson chen)
 
+- Libxml:
+  . Fixed bug #79029 (Use After Free's in XMLReader / XMLWriter). (Laruence)
+
 - Pcntl:
   . Fixed bug #78402 (Converting null to string in error message is bad DX).
     (SATŌ Kentarō)

diff --git a/ext/libxml/libxml.c b/ext/libxml/libxml.c
index b0b94b7c3a71c7264bc3cf0ac83572729070e3f0..864e5a36fb72a637235a02a96171329ba90b4a4e 100644 (file)
--- a/ext/libxml/libxml.c
+++ b/ext/libxml/libxml.c
@@ -358,6 +358,10 @@ static void *php_libxml_streams_IO_open_wrapper(const char *filename, const char
        context = php_stream_context_from_zval(Z_ISUNDEF(LIBXML(stream_context))? NULL : &LIBXML(stream_context), 0);
 
        ret_val = php_stream_open_wrapper_ex(path_to_open, (char *)mode, REPORT_ERRORS, NULL, context);
+       if (ret_val) {
+               /* Prevent from closing this by fclose() */
+               ((php_stream*)ret_val)->flags |= PHP_STREAM_FLAG_NO_FCLOSE;
+       }
        if (isescaped) {
                xmlFree(resolved_path);
        }

diff --git a/ext/xmlwriter/php_xmlwriter.c b/ext/xmlwriter/php_xmlwriter.c
index 16545fd653b5698020f2ce6f4d9d662ce120e43c..24bb9dd1829dc617612ee3de77966c6dc555be44 100644 (file)
--- a/ext/xmlwriter/php_xmlwriter.c
+++ b/ext/xmlwriter/php_xmlwriter.c
@@ -91,13 +91,15 @@ typedef int (*xmlwriter_read_int_t)(xmlTextWriterPtr writer);
 static void xmlwriter_free_resource_ptr(xmlwriter_object *intern)
 {
        if (intern) {
-               if (intern->ptr) {
-                       xmlFreeTextWriter(intern->ptr);
-                       intern->ptr = NULL;
-               }
-               if (intern->output) {
-                       xmlBufferFree(intern->output);
-                       intern->output = NULL;
+               if (EG(active)) {
+                       if (intern->ptr) {
+                               xmlFreeTextWriter(intern->ptr);
+                               intern->ptr = NULL;
+                       }
+                       if (intern->output) {
+                               xmlBufferFree(intern->output);
+                               intern->output = NULL;
+                       }
                }
                efree(intern);
        }

diff --git a/ext/xmlwriter/tests/bug79029.phpt b/ext/xmlwriter/tests/bug79029.phpt
new file mode 100644 (file)
index 0000000..2e76a4e
--- /dev/null
+++ b/ext/xmlwriter/tests/bug79029.phpt
@@ -0,0 +1,34 @@
+--TEST--
+#79029 (Use After Free's in XMLReader / XMLWriter)
+--SKIPIF--
+<?php 
+if (!extension_loaded("xmlwriter")) print "skip xmlwriter extension not available";
+if (!extension_loaded("xmlreader")) print "skip xmlreader extension not available";
+?>
+--FILE--
+<?php
+$x = array( new XMLWriter() );
+$x[0]->openUri("bug79029_1.txt");
+$x[0]->startComment();
+
+$x = new XMLWriter();
+$x->openUri("bug79029_2.txt");
+fclose(@end(get_resources()));
+
+file_put_contents("bug79029_3.txt", "a");
+$x = new XMLReader();
+$x->open("bug79029_3.txt");
+fclose(@end(get_resources()));
+?>
+okey
+--CLEAN--
+<?php
+@unlink("bug79029_1.txt");
+@unlink("bug79029_2.txt");
+@unlink("bug79029_3.txt");
+?>
+--EXPECTF--
+Warning: fclose(): %d is not a valid stream resource in %sbug79029.php on line %d
+
+Warning: fclose(): %d is not a valid stream resource in %sbug79029.php on line %d
+okey