From: Marcus Boerger <helly@php.net>
Date: Tue, 23 May 2006 21:58:44 +0000 (+0000)
Subject: - MFH Bugfix #37565
X-Git-Tag: php-5.2.0RC1~484
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=64701cf42b027cfcadba0b8cc3597a23a5351102;p=php

- MFH Bugfix #37565
---

diff --git a/NEWS b/NEWS
index 52fda2246e..7f08ae17aa 100644
--- a/NEWS
+++ b/NEWS
@@ -43,6 +43,8 @@ PHP                                                                        NEWS
 - Added pg_field_table() function. (Edin)
 - Added implementation of curl_multi_info_read(). (Brian)
 - Added RFC2397 (data: stream) support. (Marcus)
+- Fixed bug #37565 (Using reflection::export with simplexml causing a crash).
+  (Marcus)
 - Fixed bug #37514 (strtotime doesn't assume year correctly). (Derick)
 - Fixed bug #37510 (session_regenerate_id changes session_id() even on 
   failure). (Hannes)
diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c
index 85ea8edebe..909d6e4dcf 100644
--- a/ext/simplexml/simplexml.c
+++ b/ext/simplexml/simplexml.c
@@ -1837,12 +1837,10 @@ PHP_FUNCTION(simplexml_load_file)
 	char           *filename;
 	int             filename_len;
 	xmlDocPtr       docp;
-	char           *classname = "";
-	int             classname_len = 0;
 	long            options = 0;
 	zend_class_entry *ce= sxe_class_entry;
 
-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|sl", &filename, &filename_len, &classname, &classname_len, &options) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|Cl", &filename, &filename_len, &ce, &options) == FAILURE) {
 		return;
 	}
 
@@ -1852,14 +1850,6 @@ PHP_FUNCTION(simplexml_load_file)
 		RETURN_FALSE;
 	}
 
-	if (classname_len) {
-		zend_class_entry **pce;
-		if (zend_lookup_class(classname, classname_len, &pce TSRMLS_CC) == FAILURE) {
-			php_error_docref(NULL TSRMLS_CC, E_ERROR, "Class %s does not exist", classname);
-		}
-		ce = *pce;
-	}
-
 	sxe = php_sxe_object_new(ce TSRMLS_CC);
 	php_libxml_increment_doc_ref((php_libxml_node_object *)sxe, docp TSRMLS_CC);
 	php_libxml_increment_node_ptr((php_libxml_node_object *)sxe, xmlDocGetRootElement(docp), NULL TSRMLS_CC);
@@ -1877,12 +1867,10 @@ PHP_FUNCTION(simplexml_load_string)
 	char           *data;
 	int             data_len;
 	xmlDocPtr       docp;
-	char           *classname = "";
-	int             classname_len = 0;
 	long            options = 0;
 	zend_class_entry *ce= sxe_class_entry;
 
-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|sl", &data, &data_len, &classname, &classname_len, &options) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|Cl", &data, &data_len, &ce, &options) == FAILURE) {
 		return;
 	}
 
@@ -1892,14 +1880,6 @@ PHP_FUNCTION(simplexml_load_string)
 		RETURN_FALSE;
 	}
 
-	if (classname_len) {
-		zend_class_entry **pce;
-		if (zend_lookup_class(classname, classname_len, &pce TSRMLS_CC) == FAILURE) {
-			php_error_docref(NULL TSRMLS_CC, E_ERROR, "Class %s does not exist", classname);
-		}
-		ce = *pce;
-	}
-
 	sxe = php_sxe_object_new(ce TSRMLS_CC);
 	php_libxml_increment_doc_ref((php_libxml_node_object *)sxe, docp TSRMLS_CC);
 	php_libxml_increment_node_ptr((php_libxml_node_object *)sxe, xmlDocGetRootElement(docp), NULL TSRMLS_CC);
@@ -2131,11 +2111,9 @@ PHP_FUNCTION(simplexml_import_dom)
 	zval *node;
 	php_libxml_node_object *object;
 	xmlNodePtr		nodep = NULL;
-	char           *classname = "";
-	int             classname_len = 0;
 	zend_class_entry *ce= sxe_class_entry;
 
-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "o|s", &node, &classname, &classname_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "o|C", &node, &ce) == FAILURE) {
 		return;
 	}
 
@@ -2154,14 +2132,6 @@ PHP_FUNCTION(simplexml_import_dom)
 	}
 
 	if (nodep && nodep->type == XML_ELEMENT_NODE) {
-		if (classname_len) {
-			zend_class_entry **pce;
-			if (zend_lookup_class(classname, classname_len, &pce TSRMLS_CC) == FAILURE) {
-				php_error_docref(NULL TSRMLS_CC, E_ERROR, "Class %s does not exist", classname);
-			}
-			ce = *pce;
-		}
-
 		sxe = php_sxe_object_new(ce TSRMLS_CC);
 		sxe->document = object->document;
 		php_libxml_increment_doc_ref((php_libxml_node_object *)sxe, nodep->doc TSRMLS_CC);
diff --git a/ext/simplexml/tests/bug37565.phpt b/ext/simplexml/tests/bug37565.phpt
new file mode 100755
index 0000000000..95f9795c67
--- /dev/null
+++ b/ext/simplexml/tests/bug37565.phpt
@@ -0,0 +1,25 @@
+--TEST--
+Bug #37565 Using reflection::export with simplexml causing a crash 
+--FILE--
+<?php
+
+class Setting extends ReflectionObject
+{
+}
+
+Reflection::export(simplexml_load_string('<test/>', 'Setting'));
+
+Reflection::export(simplexml_load_file('data:,<test/>', 'Setting'));
+
+?>
+===DONE===
+--EXPECTF--
+
+Warning: simplexml_load_string() expects parameter 2 to be a class name derived from SimpleXMLElement, 'Setting' given in %sbug37565.php on line %d
+
+Warning: Reflection::export() expects parameter 1 to be Reflector, null given in %sbug37565.php on line %d
+
+Warning: simplexml_load_file() expects parameter 2 to be a class name derived from SimpleXMLElement, 'Setting' given in %sbug37565.php on line %d
+
+Warning: Reflection::export() expects parameter 1 to be Reflector, null given in %sbug37565.php on line %d
+===DONE===