From: Felipe Pena Date: Sun, 10 May 2009 15:15:47 +0000 (+0000) Subject: - MFH: Fixed bug #48221 (memory leak when passing invalid xslt parameter) X-Git-Tag: php-5.2.10RC1~109 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=6fbed2a9f3a320a52a0f59c4c843f7cbc487a54b;p=php - MFH: Fixed bug #48221 (memory leak when passing invalid xslt parameter) --- diff --git a/NEWS b/NEWS index feb1026169..18140edfb2 100644 --- a/NEWS +++ b/NEWS @@ -12,6 +12,7 @@ PHP NEWS - Fixed segfault on invalid session.save_path. (Hannes) - Fixed leaks in imap when a mail_criteria is used. (Pierre) +- Fixed bug #48221 (memory leak when passing invalid xslt parameter). (Felipe) - Fixed bug #48206 (Iterating over an invalid data structure with RecursiveIteratorIterator leads to a segfault). (Scott) - Fixed bug #48156 (Added support for lcov v1.7). (Ilia) diff --git a/ext/xsl/tests/bug48221.phpt b/ext/xsl/tests/bug48221.phpt new file mode 100644 index 0000000000..609112db3d --- /dev/null +++ b/ext/xsl/tests/bug48221.phpt @@ -0,0 +1,85 @@ +--TEST-- +Bug #48221 (memory leak when passing invalid xslt parameter) +--SKIPIF-- + +--FILE-- +loadXML(' + + Sales Results By Division + + + + + + + + + + + + + + + + + + + +
DivisionRevenueGrowthBonus
+ + + + + + + + color:red + + + + + +
+ +'); + +$dom = new DOMDocument; +$dom->loadXMl(' + + + 10 + 9 + 7 + + + + 4 + 3 + 4 + + + + 6 + -1.5 + 2 + + +'); + +$proc = new xsltprocessor; +$proc->importStylesheet($xsl); +$proc->setParameter('', '', '"\''); +$proc->transformToXml($dom); + +?> +--EXPECTF-- +Warning: XSLTProcessor::transformToXml(): Cannot create XPath expression (string contains both quote and double-quotes) in %s on line %d diff --git a/ext/xsl/xsltprocessor.c b/ext/xsl/xsltprocessor.c index c88bf762ff..6bf551e3a0 100644 --- a/ext/xsl/xsltprocessor.c +++ b/ext/xsl/xsltprocessor.c @@ -157,11 +157,13 @@ static char **php_xsl_xslt_make_params(HashTable *parht, int xpath_params TSRMLS if (!xpath_params) { xpath_expr = php_xsl_xslt_string_to_xpathexpr(Z_STRVAL_PP(value) TSRMLS_CC); } else { - xpath_expr = estrndup(Z_STRVAL_PP(value), strlen(Z_STRVAL_PP(value))); + xpath_expr = estrndup(Z_STRVAL_PP(value), Z_STRLEN_PP(value)); } if (xpath_expr) { params[i++] = string_key; params[i++] = xpath_expr; + } else { + efree(string_key); } } }