fix bug #34965 tidy is not binary safe

diff --git a/ext/tidy/tests/018.phpt b/ext/tidy/tests/018.phpt
new file mode 100644 (file)
index 0000000..405a46d
--- /dev/null
+++ b/ext/tidy/tests/018.phpt
@@ -0,0 +1,16 @@
+--TEST--
+binary safety
+--SKIPIF--
+<?php if (!extension_loaded("tidy")) print "skip"; ?>
+--FILE--
+<?php
+$x = tidy_repair_string("<p>abra\0cadabra</p>", 
+       array(  'show-body-only' => true, 
+                       'clean' => false,
+                       'newline' => "\n")
+       );
+var_dump($x);
+?>
+--EXPECT--
+string(19) "<p>abracadabra</p>
+"

diff --git a/ext/tidy/tidy.c b/ext/tidy/tidy.c
index 730be7a547bdb4bad25ae80028a380ba801feebc..9b0e33bbe9d3613f9f3dd23c4b83a74cff62aa8c 100644 (file)
--- a/ext/tidy/tidy.c
+++ b/ext/tidy/tidy.c
@@ -127,6 +127,18 @@
                zend_hash_update(_table, #_key, sizeof(#_key), (void *)&tmp, sizeof(zval *), NULL); \
        }
 
+#define ADD_PROPERTY_STRINGL(_table, _key, _string, _len) \
+   { \
+       zval *tmp; \
+       MAKE_STD_ZVAL(tmp); \
+       if (_string) { \
+           ZVAL_STRINGL(tmp, (char *)_string, _len, 1); \
+       } else { \
+           ZVAL_EMPTY_STRING(tmp); \
+       } \
+       zend_hash_update(_table, #_key, sizeof(#_key), (void *)&tmp, sizeof(zval *), NULL); \
+   }
+
 #define ADD_PROPERTY_LONG(_table, _key, _long) \
        { \
                zval *tmp; \
@@ -198,7 +210,7 @@ struct _PHPTidyObj {
 
 /* {{{ ext/tidy prototypes
 */
-static char *php_tidy_file_to_mem(char *, zend_bool TSRMLS_DC);
+static char *php_tidy_file_to_mem(char *, zend_bool, int * TSRMLS_DC);
 static void tidy_object_free_storage(void * TSRMLS_DC);
 static zend_object_value tidy_object_new_node(zend_class_entry * TSRMLS_DC);
 static zend_object_value tidy_object_new_doc(zend_class_entry * TSRMLS_DC);
@@ -405,7 +417,7 @@ static int _php_tidy_set_tidy_opt(TidyDoc doc, char *optname, zval *value TSRMLS
 static void php_tidy_quick_repair(INTERNAL_FUNCTION_PARAMETERS, zend_bool is_file)
 {
        char *data=NULL, *arg1, *enc = NULL;
-       int arg1_len, enc_len = 0;
+       int arg1_len, enc_len = 0, data_len = 0;
        zend_bool use_include_path = 0;
        TidyDoc doc;
        TidyBuffer *errbuf;
@@ -418,11 +430,12 @@ static void php_tidy_quick_repair(INTERNAL_FUNCTION_PARAMETERS, zend_bool is_fil
        }
        
        if (is_file) {
-               if (!(data = php_tidy_file_to_mem(arg1, use_include_path TSRMLS_CC))) {
+               if (!(data = php_tidy_file_to_mem(arg1, use_include_path, &data_len TSRMLS_CC))) {
                        RETURN_FALSE;
                }
        } else {
                data = arg1;
+               data_len = arg1_len;
        }
 
        doc = tidyCreate();
@@ -464,7 +477,12 @@ static void php_tidy_quick_repair(INTERNAL_FUNCTION_PARAMETERS, zend_bool is_fil
        }
        
        if (data) {
-               if (tidyParseString(doc, data) < 0) {
+               TidyBuffer buf = {0};
+               
+               tidyBufInit(&buf);
+               tidyBufAppend(&buf, data, data_len);
+               
+               if (tidyParseBuffer(doc, &buf) < 0) {
                        php_error_docref(NULL TSRMLS_CC, E_WARNING, "%s", errbuf->bp);
                        RETVAL_FALSE;
                } else {
@@ -472,12 +490,14 @@ static void php_tidy_quick_repair(INTERNAL_FUNCTION_PARAMETERS, zend_bool is_fil
                                TidyBuffer output = {0};
 
                                tidySaveBuffer (doc, &output);
-                               RETVAL_STRING(output.bp, 1);
+                               RETVAL_STRINGL(output.bp, output.size-1, 1);
                                tidyBufFree(&output);
                        } else {
                                RETVAL_FALSE;
                        }
                }
+               
+               tidyBufFree(&buf);
        }
 
        if (is_file) {
@@ -489,17 +509,17 @@ static void php_tidy_quick_repair(INTERNAL_FUNCTION_PARAMETERS, zend_bool is_fil
        tidyRelease(doc);
 }
 
-static char *php_tidy_file_to_mem(char *filename, zend_bool use_include_path TSRMLS_DC)
+static char *php_tidy_file_to_mem(char *filename, zend_bool use_include_path, int *len TSRMLS_DC)
 {
        php_stream *stream;
-       int len;
        char *data = NULL;
 
        if (!(stream = php_stream_open_wrapper(filename, "rb", (use_include_path ? USE_PATH : 0) | ENFORCE_SAFE_MODE, NULL))) {
                return NULL;
        }
-       if ((len = php_stream_copy_to_mem(stream, &data, PHP_STREAM_COPY_ALL, 0)) == 0) {
+       if ((*len = (int) php_stream_copy_to_mem(stream, &data, PHP_STREAM_COPY_ALL, 0)) == 0) {
                data = estrdup("");
+               *len = 0;
        }
        php_stream_close(stream);
 
@@ -647,7 +667,7 @@ static int tidy_doc_cast_handler(zval *in, zval *out, int type TSRMLS_DC)
                case IS_STRING:
                        obj = (PHPTidyObj *)zend_object_store_get_object(in TSRMLS_CC);
                        tidySaveBuffer (obj->ptdoc->doc, &output);
-                       ZVAL_STRINGL(out, output.bp, output.size, TRUE);
+                       ZVAL_STRINGL(out, output.bp, output.size-1, TRUE);
                        tidyBufFree(&output);
                        break;
 
@@ -679,7 +699,7 @@ static int tidy_node_cast_handler(zval *in, zval *out, int type TSRMLS_DC)
                case IS_STRING:
                        obj = (PHPTidyObj *)zend_object_store_get_object(in TSRMLS_CC);
                        tidyNodeGetText(obj->ptdoc->doc, obj->node, &buf);
-                       ZVAL_STRINGL(out, buf.bp, buf.size, TRUE);
+                       ZVAL_STRINGL(out, buf.bp, buf.size-1, TRUE);
                        tidyBufFree(&buf);
                        break;
 
@@ -700,7 +720,7 @@ static void tidy_doc_update_properties(PHPTidyObj *obj TSRMLS_DC)
        
        if (output.size) {
                MAKE_STD_ZVAL(temp);
-               ZVAL_STRINGL(temp, output.bp, output.size, TRUE);
+               ZVAL_STRINGL(temp, output.bp, output.size-1, TRUE);
                zend_hash_update(obj->std.properties, "value", sizeof("value"), (void *)&temp, sizeof(zval *), NULL);
        }
        
@@ -708,7 +728,7 @@ static void tidy_doc_update_properties(PHPTidyObj *obj TSRMLS_DC)
 
        if (obj->ptdoc->errbuf->size) {
                MAKE_STD_ZVAL(temp);
-               ZVAL_STRINGL(temp, obj->ptdoc->errbuf->bp, obj->ptdoc->errbuf->size, TRUE);
+               ZVAL_STRINGL(temp, obj->ptdoc->errbuf->bp, obj->ptdoc->errbuf->size-1, TRUE);
                zend_hash_update(obj->std.properties, "errorBuffer", sizeof("errorBuffer"), (void *)&temp, sizeof(zval *), NULL);
        }
 }
@@ -728,8 +748,7 @@ static void tidy_add_default_properties(PHPTidyObj *obj, tidy_obj_type type TSRM
 
                        memset(&buf, 0, sizeof(buf));
                        tidyNodeGetText(obj->ptdoc->doc, obj->node, &buf);
-                       buf.bp[buf.size-1] = '\0';
-                       ADD_PROPERTY_STRING(obj->std.properties, value, buf.bp);
+                       ADD_PROPERTY_STRINGL(obj->std.properties, value, buf.bp, buf.size-1);
                        tidyBufFree(&buf);
 
                        ADD_PROPERTY_STRING(obj->std.properties, name, tidyNodeGetName(obj->node));
@@ -891,8 +910,10 @@ static int _php_tidy_apply_config_array(TidyDoc doc, HashTable *ht_options TSRML
        return SUCCESS;
 }
 
-static int php_tidy_parse_string(PHPTidyObj *obj, char *string, char *enc TSRMLS_DC)
-{      
+static int php_tidy_parse_string(PHPTidyObj *obj, char *string, int len, char *enc TSRMLS_DC)
+{
+       TidyBuffer buf = {0};
+       
        if(enc) {
                if (tidySetCharEncoding(obj->ptdoc->doc, enc) < 0) {
                        php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not set encoding '%s'", enc);
@@ -900,18 +921,18 @@ static int php_tidy_parse_string(PHPTidyObj *obj, char *string, char *enc TSRMLS
                }
        }
        
-       if (tidyParseString(obj->ptdoc->doc, string) < 0) {
+       tidyBufInit(&buf);
+       tidyBufAppend(&buf, string, len);
+       if (tidyParseBuffer(obj->ptdoc->doc, &buf) < 0) {
+               tidyBufFree(&buf);
                php_error_docref(NULL TSRMLS_CC, E_WARNING, "%s", obj->ptdoc->errbuf->bp);
                return FAILURE;
        
-       } else {
-               tidy_doc_update_properties(obj TSRMLS_CC);
-
-               return SUCCESS;
        }
-       
+       tidyBufFree(&buf);
        tidy_doc_update_properties(obj TSRMLS_CC);
-       
+
+       return SUCCESS;
 }
 
 static void tidy_globals_ctor(void *global TSRMLS_DC)
@@ -996,7 +1017,12 @@ PHP_FUNCTION(ob_tidyhandler)
        TIDY_SET_DEFAULT_CONFIG(doc);
 
        if (input_len > 1) {
-               if (tidyParseString(doc, input) < 0 || tidyCleanAndRepair(doc) < 0) {
+               TidyBuffer buf = {0};
+               
+               tidyBufInit(&buf);
+               tidyBufAppend(&buf, input, input_len);
+               
+               if (tidyParseBuffer(doc, &buf) < 0 || tidyCleanAndRepair(doc) < 0) {
                        php_error_docref(NULL TSRMLS_CC, E_WARNING, "%s", errbuf.bp);
                        RETVAL_NULL();
                } else {
@@ -1004,10 +1030,12 @@ PHP_FUNCTION(ob_tidyhandler)
                        tidyBufInit(&output);
 
                        tidySaveBuffer(doc, &output);
-                       RETVAL_STRING(output.bp, 1);
+                       RETVAL_STRINGL(output.bp, output.size-1, 1);
 
                        tidyBufFree(&output);
                }
+               
+               tidyBufFree(&buf);
        } else {
                RETVAL_NULL();
        }
@@ -1037,7 +1065,7 @@ PHP_FUNCTION(tidy_parse_string)
                
        TIDY_APPLY_CONFIG_ZVAL(obj->ptdoc->doc, options);
        
-       if(php_tidy_parse_string(obj, input, enc TSRMLS_CC) == FAILURE) {
+       if(php_tidy_parse_string(obj, input, input_len, enc TSRMLS_CC) == FAILURE) {
                zval_dtor(return_value);
                INIT_ZVAL(*return_value);
                RETURN_FALSE;
@@ -1053,7 +1081,7 @@ PHP_FUNCTION(tidy_get_error_buffer)
        TIDY_FETCH_OBJECT;
 
        if (obj->ptdoc->errbuf && obj->ptdoc->errbuf->bp) {
-               RETURN_STRING(obj->ptdoc->errbuf->bp, 1);
+               RETURN_STRINGL(obj->ptdoc->errbuf->bp, obj->ptdoc->errbuf->size-1, 1);
        } else {
                RETURN_FALSE;
        }
@@ -1069,7 +1097,7 @@ PHP_FUNCTION(tidy_get_output)
 
        tidySaveBuffer(obj->ptdoc->doc, &output);
 
-       RETVAL_STRING(output.bp, 1);
+       RETVAL_STRINGL(output.bp, output.size-1, 1);
 
        tidyBufFree(&output);
 }
@@ -1080,7 +1108,7 @@ PHP_FUNCTION(tidy_get_output)
 PHP_FUNCTION(tidy_parse_file)
 {
        char *inputfile, *enc = NULL;
-       int input_len, enc_len = 0;
+       int input_len, contents_len, enc_len = 0;
        zend_bool use_include_path = 0;
        char *contents;
        zval *options = NULL;
@@ -1096,14 +1124,14 @@ PHP_FUNCTION(tidy_parse_file)
        tidy_instanciate(tidy_ce_doc, return_value TSRMLS_CC);
        obj = (PHPTidyObj *) zend_object_store_get_object(return_value TSRMLS_CC);
 
-       if (!(contents = php_tidy_file_to_mem(inputfile, use_include_path TSRMLS_CC))) {
+       if (!(contents = php_tidy_file_to_mem(inputfile, use_include_path, &contents_len TSRMLS_CC))) {
                php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot Load '%s' into memory %s", inputfile, (use_include_path) ? "(Using include path)" : "");
                RETURN_FALSE;
        }
 
        TIDY_APPLY_CONFIG_ZVAL(obj->ptdoc->doc, options);
 
-       if(php_tidy_parse_string(obj, contents, enc TSRMLS_CC) == FAILURE) {
+       if(php_tidy_parse_string(obj, contents, contents_len, enc TSRMLS_CC) == FAILURE) {
                zval_dtor(return_value);
                INIT_ZVAL(*return_value);
                RETVAL_FALSE;
@@ -1398,7 +1426,7 @@ PHP_FUNCTION(tidy_getopt)
 TIDY_DOC_METHOD(__construct)
 {
        char *inputfile = NULL, *enc = NULL;
-       int input_len = 0, enc_len = 0;
+       int input_len = 0, enc_len = 0, contents_len = 0;
        zend_bool use_include_path = 0;
        char *contents;
        zval *options = NULL;
@@ -1414,14 +1442,14 @@ TIDY_DOC_METHOD(__construct)
        obj = (PHPTidyObj *)zend_object_store_get_object(object TSRMLS_CC);
        
        if (inputfile) {
-               if (!(contents = php_tidy_file_to_mem(inputfile, use_include_path TSRMLS_CC))) {
+               if (!(contents = php_tidy_file_to_mem(inputfile, use_include_path, &contents_len TSRMLS_CC))) {
                        php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot Load '%s' into memory %s", inputfile, (use_include_path) ? "(Using include path)" : "");
                        return;
                }
 
                TIDY_APPLY_CONFIG_ZVAL(obj->ptdoc->doc, options);
 
-               php_tidy_parse_string(obj, contents, enc TSRMLS_CC);
+               php_tidy_parse_string(obj, contents, contents_len, enc TSRMLS_CC);
 
                efree(contents);
        }
@@ -1430,7 +1458,7 @@ TIDY_DOC_METHOD(__construct)
 TIDY_DOC_METHOD(parseFile)
 {
        char *inputfile, *enc = NULL;
-       int input_len, enc_len = 0;
+       int input_len, enc_len = 0, contents_len = 0;
        zend_bool use_include_path = 0;
        char *contents;
        zval *options = NULL;
@@ -1445,14 +1473,14 @@ TIDY_DOC_METHOD(parseFile)
                RETURN_FALSE;
        }
        
-       if (!(contents = php_tidy_file_to_mem(inputfile, use_include_path TSRMLS_CC))) {
+       if (!(contents = php_tidy_file_to_mem(inputfile, use_include_path, &contents_len TSRMLS_CC))) {
                php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot Load '%s' into memory %s", inputfile, (use_include_path) ? "(Using include path)" : "");
                RETURN_FALSE;
        }
 
        TIDY_APPLY_CONFIG_ZVAL(obj->ptdoc->doc, options);
 
-       if(php_tidy_parse_string(obj, contents, enc TSRMLS_CC) == FAILURE) {
+       if(php_tidy_parse_string(obj, contents, contents_len, enc TSRMLS_CC) == FAILURE) {
                RETVAL_FALSE;
        } else {
                RETVAL_TRUE;
@@ -1478,7 +1506,7 @@ TIDY_DOC_METHOD(parseString)
 
        TIDY_APPLY_CONFIG_ZVAL(obj->ptdoc->doc, options);
 
-       if(php_tidy_parse_string(obj, input, enc TSRMLS_CC) == SUCCESS) {
+       if(php_tidy_parse_string(obj, input, input_len, enc TSRMLS_CC) == SUCCESS) {
                RETURN_TRUE;
        }