Fix NULL pointer dereference with NULL content in legacy nodes (#15546)

nielsdos · web-flow · commit 793f6321e792 · 2024-08-23T08:56:06.000+02:00
diff --git a/ext/dom/html5_serializer.c b/ext/dom/html5_serializer.c
@@ -42,7 +42,9 @@ static zend_result dom_html5_serialize_doctype(dom_html5_serialize_context *ctx,
 static zend_result dom_html5_serialize_comment(dom_html5_serialize_context *ctx, const xmlNode *node)
 {
 	TRY(ctx->write_string_len(ctx->application_data, "<!--", strlen("<!--")));
-	TRY(ctx->write_string(ctx->application_data, (const char *) node->content));
+	if (node->content) {
+		TRY(ctx->write_string(ctx->application_data, (const char*) node->content));
+	}
 	return ctx->write_string_len(ctx->application_data, "-->", strlen("-->"));
 }
 
@@ -131,6 +133,10 @@ static zend_result dom_html5_escape_string(dom_html5_serialize_context *ctx, con
 
 static zend_result dom_html5_serialize_text_node(dom_html5_serialize_context *ctx, const xmlNode *node)
 {
+	if (!node->content) {
+		return SUCCESS;
+	}
+
 	if (node->parent->type == XML_ELEMENT_NODE && php_dom_ns_is_fast(node->parent, php_dom_ns_is_html_magic_token)) {
 		const xmlNode *parent = node->parent;
 		size_t name_length = strlen((const char *) parent->name);
diff --git a/ext/dom/tests/modern/html/serializer/legacy_null_content.phpt b/ext/dom/tests/modern/html/serializer/legacy_null_content.phpt
@@ -0,0 +1,20 @@
+--TEST--
+Serialize legacy nodes with NULL content
+--EXTENSIONS--
+dom
+--FILE--
+<?php
+$dom = Dom\HTMLDocument::createEmpty();
+$root = $dom->appendChild($dom->createElement('html'));
+
+$root->appendChild($dom->importLegacyNode(new DOMText));
+$root->appendChild($dom->importLegacyNode(new DOMComment));
+$root->appendChild($dom->importLegacyNode(new DOMProcessingInstruction('target')));
+$root->appendChild($dom->importLegacyNode(new DOMCdataSection('')));
+
+echo $dom->saveHTML(), "\n";
+echo $dom->documentElement->innerHTML, "\n";
+?>
+--EXPECT--
+<html><!----><?target ></html>
+<!----><?target >

Original file line number	Diff line number	Diff line change
`@@ -42,7 +42,9 @@ static zend_result dom_html5_serialize_doctype(dom_html5_serialize_context *ctx,`
`42`	`42`	`static zend_result dom_html5_serialize_comment(dom_html5_serialize_context ctx, const xmlNode node)`
`43`	`43`	`{`
`44`	`44`	`TRY(ctx->write_string_len(ctx->application_data, "<!--", strlen("<!--")));`
`45`		`- TRY(ctx->write_string(ctx->application_data, (const char *) node->content));`
	`45`	`+ if (node->content) {`
	`46`	`+ TRY(ctx->write_string(ctx->application_data, (const char*) node->content));`
	`47`	`+ }`
`46`	`48`	`return ctx->write_string_len(ctx->application_data, "-->", strlen("-->"));`
`47`	`49`	`}`
`48`	`50`
`@@ -131,6 +133,10 @@ static zend_result dom_html5_escape_string(dom_html5_serialize_context *ctx, con`
`131`	`133`
`132`	`134`	`static zend_result dom_html5_serialize_text_node(dom_html5_serialize_context ctx, const xmlNode node)`
`133`	`135`	`{`
	`136`	`+ if (!node->content) {`
	`137`	`+ return SUCCESS;`
	`138`	`+ }`
	`139`	`+`
`134`	`140`	`if (node->parent->type == XML_ELEMENT_NODE && php_dom_ns_is_fast(node->parent, php_dom_ns_is_html_magic_token)) {`
`135`	`141`	`const xmlNode *parent = node->parent;`
`136`	`142`	`size_t name_length = strlen((const char *) parent->name);`