Fix bug #71540 - NULL pointer dereference in xsl_ext_function_php()
authorStanislav Malyshev <stas@php.net>
Mon, 15 Feb 2016 07:35:29 +0000 (23:35 -0800)
committerStanislav Malyshev <stas@php.net>
Mon, 15 Feb 2016 08:08:18 +0000 (00:08 -0800)
NEWS
ext/xsl/tests/bug71540.phpt [new file with mode: 0644]
ext/xsl/xsltprocessor.c

diff --git a/NEWS b/NEWS
index 51a9555505870a0096802df2f74834da560f8546..5d641b4f1d7c594dec19f2504e14d529c355ac1c 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -31,6 +31,10 @@ PHP                                                                        NEWS
 - Standard:
   . Fixed bug #70720 (strip_tags improper php code parsing). (Julien)
 
+- XSL:
+  . Fixed bug #71540 (NULL pointer dereference in xsl_ext_function_php()).
+    (Stas)
+
 - Zip:
   . Fixed bug #71561 (NULL pointer dereference in Zip::ExtractTo). (Laruence)
 
diff --git a/ext/xsl/tests/bug71540.phpt b/ext/xsl/tests/bug71540.phpt
new file mode 100644 (file)
index 0000000..e93fb0e
--- /dev/null
@@ -0,0 +1,67 @@
+--TEST--
+Bug #71540 (NULL pointer dereference in xsl_ext_function_php())
+--SKIPIF--
+<?php
+if (!extension_loaded('xsl')) die("skip Extension XSL is required\n");
+?>
+--FILE--
+<?php
+$xml = <<<EOB
+<allusers>
+ <user>
+  <uid>bob</uid>
+ </user>
+</allusers>
+EOB;
+$xsl = <<<EOB
+<?xml version="1.0" encoding="UTF-8"?>
+<xsl:stylesheet version="1.0" 
+     xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+     xmlns:php="http://php.net/xsl">
+<xsl:output method="html" encoding="utf-8" indent="yes"/>
+ <xsl:template match="allusers">
+  <html><body>
+    <h2>Users</h2>
+    <table>
+    <xsl:for-each select="user">
+      <tr><td>
+        <xsl:value-of
+             select="php:function('test',uid,test(test))"/>
+      </td></tr>
+    </xsl:for-each>
+    </table>
+  </body></html>
+ </xsl:template>
+</xsl:stylesheet>
+EOB;
+
+$xmldoc = new DOMDocument();
+$xmldoc->loadXML($xml);
+$xsldoc = new DOMDocument();
+$xsldoc->loadXML($xsl);
+
+$proc = new XSLTProcessor();
+$proc->registerPHPFunctions();
+$proc->importStyleSheet($xsldoc);
+echo $proc->transformToXML($xmldoc);
+?>
+DONE
+--EXPECTF--
+Warning: XSLTProcessor::transformToXml(): xmlXPathCompOpEval: function test not found in %sbug71540.php on line %d
+
+Warning: XSLTProcessor::transformToXml(): Unregistered function in %sbug71540.php on line %d
+
+Warning: XSLTProcessor::transformToXml(): Stack usage errror in %sbug71540.php on line %d
+
+Warning: XSLTProcessor::transformToXml(): Stack usage errror in %sbug71540.php on line %d
+
+Warning: XSLTProcessor::transformToXml(): xmlXPathCompiledEval: 2 objects left on the stack. in %sbug71540.php on line %d
+
+Warning: XSLTProcessor::transformToXml(): runtime error: file %s line 13 element value-of in %sbug71540.php on line %d
+
+Warning: XSLTProcessor::transformToXml(): XPath evaluation returned no result. in %sbug71540.php on line %d
+<html xmlns:php="http://php.net/xsl"><body>
+<h2>Users</h2>
+<table><tr><td></td></tr></table>
+</body></html>
+DONE
\ No newline at end of file
index 691c78c470eae2180765fcfd159b5eb2af703819..5d346519304c34762c35972955a9894da6ccf8f8 100644 (file)
@@ -239,6 +239,10 @@ static void xsl_ext_function_php(xmlXPathParserContextPtr ctxt, int nargs, int t
        for (i = nargs - 2; i >= 0; i--) {
                obj = valuePop(ctxt);
                MAKE_STD_ZVAL(args[i]);
+               if (obj == NULL) {
+                       ZVAL_NULL(args[i]);
+                       continue;
+               }
                switch (obj->type) {
                        case XPATH_STRING:
                                ZVAL_STRING(args[i],  obj->stringval, 1);