196963
From 7d163e8a0880ae8af2dd869071393e5dc07ef271 Mon Sep 17 00:00:00 2001
196963
From: Rob Richards <rrichards@php.net>
196963
Date: Sat, 6 Jul 2013 07:53:07 -0400
196963
Subject: [PATCH] truncate results at depth of 255 to prevent corruption
196963
196963
---
196963
 ext/xml/xml.c | 90 +++++++++++++++++++++++++++++++++--------------------------
196963
 1 file changed, 50 insertions(+), 40 deletions(-)
196963
196963
diff --git a/ext/xml/xml.c b/ext/xml/xml.c
196963
index 1f0480b..9f0bc30 100644
196963
--- a/ext/xml/xml.c
196963
+++ b/ext/xml/xml.c
196963
@@ -428,7 +428,7 @@ static void xml_parser_dtor(zend_rsrc_list_entry *rsrc TSRMLS_DC)
196963
 	}
196963
 	if (parser->ltags) {
196963
 		int inx;
196963
-		for (inx = 0; inx < parser->level; inx++)
196963
+		for (inx = 0; ((inx < parser->level) && (inx < XML_MAXLEVEL)); inx++)
196963
 			efree(parser->ltags[ inx ]);
196963
 		efree(parser->ltags);
196963
 	}
196963
@@ -805,45 +805,50 @@ void _xml_startElementHandler(void *userData, const XML_Char *name, const XML_Ch
196963
 		} 
196963
 
196963
 		if (parser->data) {
196963
-			zval *tag, *atr;
196963
-			int atcnt = 0;
196963
+			if (parser->level <= XML_MAXLEVEL)  {
196963
+				zval *tag, *atr;
196963
+				int atcnt = 0;
196963
 
196963
-			MAKE_STD_ZVAL(tag);
196963
-			MAKE_STD_ZVAL(atr);
196963
+				MAKE_STD_ZVAL(tag);
196963
+				MAKE_STD_ZVAL(atr);
196963
 
196963
-			array_init(tag);
196963
-			array_init(atr);
196963
+				array_init(tag);
196963
+				array_init(atr);
196963
 
196963
-			_xml_add_to_info(parser,((char *) tag_name) + parser->toffset);
196963
+				_xml_add_to_info(parser,((char *) tag_name) + parser->toffset);
196963
 
196963
-			add_assoc_string(tag,"tag",((char *) tag_name) + parser->toffset,1); /* cast to avoid gcc-warning */
196963
-			add_assoc_string(tag,"type","open",1);
196963
-			add_assoc_long(tag,"level",parser->level);
196963
+				add_assoc_string(tag,"tag",((char *) tag_name) + parser->toffset,1); /* cast to avoid gcc-warning */
196963
+				add_assoc_string(tag,"type","open",1);
196963
+				add_assoc_long(tag,"level",parser->level);
196963
 
196963
-			parser->ltags[parser->level-1] = estrdup(tag_name);
196963
-			parser->lastwasopen = 1;
196963
+				parser->ltags[parser->level-1] = estrdup(tag_name);
196963
+				parser->lastwasopen = 1;
196963
 
196963
-			attributes = (const XML_Char **) attrs;
196963
+				attributes = (const XML_Char **) attrs;
196963
 
196963
-			while (attributes && *attributes) {
196963
-				att = _xml_decode_tag(parser, attributes[0]);
196963
-				val = xml_utf8_decode(attributes[1], strlen(attributes[1]), &val_len, parser->target_encoding);
196963
-				
196963
-				add_assoc_stringl(atr,att,val,val_len,0);
196963
+				while (attributes && *attributes) {
196963
+					att = _xml_decode_tag(parser, attributes[0]);
196963
+					val = xml_utf8_decode(attributes[1], strlen(attributes[1]), &val_len, parser->target_encoding);
196963
 
196963
-				atcnt++;
196963
-				attributes += 2;
196963
+					add_assoc_stringl(atr,att,val,val_len,0);
196963
 
196963
-				efree(att);
196963
-			}
196963
+					atcnt++;
196963
+					attributes += 2;
196963
 
196963
-			if (atcnt) {
196963
-				zend_hash_add(Z_ARRVAL_P(tag),"attributes",sizeof("attributes"),&atr,sizeof(zval*),NULL);
196963
-			} else {
196963
-				zval_ptr_dtor(&atr;;
196963
-			}
196963
+					efree(att);
196963
+				}
196963
+
196963
+				if (atcnt) {
196963
+					zend_hash_add(Z_ARRVAL_P(tag),"attributes",sizeof("attributes"),&atr,sizeof(zval*),NULL);
196963
+				} else {
196963
+					zval_ptr_dtor(&atr;;
196963
+				}
196963
 
196963
-			zend_hash_next_index_insert(Z_ARRVAL_P(parser->data),&tag,sizeof(zval*),(void *) &parser->ctag);
196963
+				zend_hash_next_index_insert(Z_ARRVAL_P(parser->data),&tag,sizeof(zval*),(void *) &parser->ctag);
196963
+			} else if (parser->level == (XML_MAXLEVEL + 1)) {
196963
+				TSRMLS_FETCH();
196963
+				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Maximum depth exceeded - Results truncated");
196963
+			}
196963
 		}
196963
 
196963
 		efree(tag_name);
196963
@@ -895,7 +900,7 @@ void _xml_endElementHandler(void *userData, const XML_Char *name)
196963
 
196963
 		efree(tag_name);
196963
 
196963
-		if (parser->ltags) {
196963
+		if ((parser->ltags) && (parser->level <= XML_MAXLEVEL)) {
196963
 			efree(parser->ltags[parser->level-1]);
196963
 		}
196963
 
196963
@@ -979,18 +984,23 @@ void _xml_characterDataHandler(void *userData, const XML_Char *s, int len)
196963
 						}
196963
 					}
196963
 
196963
-					MAKE_STD_ZVAL(tag);
196963
-					
196963
-					array_init(tag);
196963
-					
196963
-					_xml_add_to_info(parser,parser->ltags[parser->level-1] + parser->toffset);
196963
+					if (parser->level <= XML_MAXLEVEL) {
196963
+						MAKE_STD_ZVAL(tag);
196963
 
196963
-					add_assoc_string(tag,"tag",parser->ltags[parser->level-1] + parser->toffset,1);
196963
-					add_assoc_string(tag,"value",decoded_value,0);
196963
-					add_assoc_string(tag,"type","cdata",1);
196963
-					add_assoc_long(tag,"level",parser->level);
196963
+						array_init(tag);
196963
 
196963
-					zend_hash_next_index_insert(Z_ARRVAL_P(parser->data),&tag,sizeof(zval*),NULL);
196963
+						_xml_add_to_info(parser,parser->ltags[parser->level-1] + parser->toffset);
196963
+
196963
+						add_assoc_string(tag,"tag",parser->ltags[parser->level-1] + parser->toffset,1);
196963
+						add_assoc_string(tag,"value",decoded_value,0);
196963
+						add_assoc_string(tag,"type","cdata",1);
196963
+						add_assoc_long(tag,"level",parser->level);
196963
+
196963
+						zend_hash_next_index_insert(Z_ARRVAL_P(parser->data),&tag,sizeof(zval*),NULL);
196963
+					} else if (parser->level == (XML_MAXLEVEL + 1)) {
196963
+						TSRMLS_FETCH();
196963
+						php_error_docref(NULL TSRMLS_CC, E_WARNING, "Maximum depth exceeded - Results truncated");
196963
+					}
196963
 				}
196963
 			} else {
196963
 				efree(decoded_value);
196963
-- 
196963
1.7.11.5
196963
196963
From 710eee5555bc5c95692bd3c84f5d2b5d687349b6 Mon Sep 17 00:00:00 2001
196963
From: =?utf8?q?Johannes=20Schl=C3=BCter?= <johannes@php.net>
196963
Date: Wed, 10 Jul 2013 19:35:18 +0200
196963
Subject: [PATCH] add test for bug #65236
196963
196963
---
196963
 ext/xml/tests/bug65236.phpt | 15 +++++++++++++++
196963
 1 file changed, 15 insertions(+)
196963
 create mode 100644 ext/xml/tests/bug65236.phpt
196963
196963
diff --git a/ext/xml/tests/bug65236.phpt b/ext/xml/tests/bug65236.phpt
196963
new file mode 100644
196963
index 0000000..67b26d6
196963
--- /dev/null
196963
+++ b/ext/xml/tests/bug65236.phpt
196963
@@ -0,0 +1,15 @@
196963
+--TEST--
196963
+Bug #65236 (heap corruption in xml parser)
196963
+--SKIPIF--
196963
+
196963
+require_once("skipif.inc");
196963
+?>
196963
+--FILE--
196963
+
196963
+xml_parse_into_struct(xml_parser_create_ns(), str_repeat("<blah>", 1000), $a);
196963
+
196963
+echo "Done\n";
196963
+?>
196963
+--EXPECTF--
196963
+Warning: xml_parse_into_struct(): Maximum depth exceeded - Results truncated in %s on line %d
196963
+Done
196963
-- 
196963
1.7.11.5
196963