Skip to content

Commit c36a1ea

Browse files
GirgiasGirgias
committed
Merge branch 'PHP-8.0' into PHP-8.1
2 parents 5d196d9 + ba029fc commit c36a1ea

File tree

5 files changed

+87
-2
lines changed

5 files changed

+87
-2
lines changed

‎NEWS

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,14 @@ PHP NEWS
22
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
33
?? ??? ????, PHP 8.1.11
44

5+
- Core:
6+
. Fixed bug GH-9323 (Crash in ZEND_RETURN/GC/zend_call_function)
7+
(Tim Starling)
8+
9+
- DOM:
10+
. Fixed bug #79451 (Using DOMDocument->replaceChild on doctype causes
11+
double free) (NathanFreeman)
12+
513
- Streams:
614
. Fixed bug GH-9316 ($http_response_header is wrong for long status line).
715
(cmb, timwolla)

‎Zend/zend_vm_def.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4329,6 +4329,7 @@ ZEND_VM_INLINE_HANDLER(62, ZEND_RETURN, CONST|TMP|VAR|CV, ANY, SPEC(OBSERVER))
43294329
zend_refcounted *ref = Z_COUNTED_P(retval_ptr);
43304330
ZVAL_COPY_VALUE(return_value, retval_ptr);
43314331
if (GC_MAY_LEAK(ref)) {
4332+
SAVE_OPLINE();
43324333
gc_possible_root(ref);
43334334
}
43344335
ZVAL_NULL(retval_ptr);
@@ -8365,8 +8366,8 @@ ZEND_VM_C_LABEL(check_indirect):
83658366
zend_refcounted *garbage = Z_COUNTED_P(variable_ptr);
83668367

83678368
ZVAL_REF(variable_ptr, ref);
8369+
SAVE_OPLINE();
83688370
if (GC_DELREF(garbage) == 0) {
8369-
SAVE_OPLINE();
83708371
rc_dtor_func(garbage);
83718372
if (UNEXPECTED(EG(exception))) {
83728373
ZVAL_NULL(variable_ptr);

‎Zend/zend_vm_execute.h

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4217,6 +4217,7 @@ static ZEND_VM_HOT ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_RETURN_SPEC_CONST_
42174217
zend_refcounted *ref = Z_COUNTED_P(retval_ptr);
42184218
ZVAL_COPY_VALUE(return_value, retval_ptr);
42194219
if (GC_MAY_LEAK(ref)) {
4220+
SAVE_OPLINE();
42204221
gc_possible_root(ref);
42214222
}
42224223
ZVAL_NULL(retval_ptr);
@@ -4294,6 +4295,7 @@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_RETURN_SPEC_OBSER
42944295
zend_refcounted *ref = Z_COUNTED_P(retval_ptr);
42954296
ZVAL_COPY_VALUE(return_value, retval_ptr);
42964297
if (GC_MAY_LEAK(ref)) {
4298+
SAVE_OPLINE();
42974299
gc_possible_root(ref);
42984300
}
42994301
ZVAL_NULL(retval_ptr);
@@ -18796,6 +18798,7 @@ static ZEND_VM_HOT ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_RETURN_SPEC_TMP_HA
1879618798
zend_refcounted *ref = Z_COUNTED_P(retval_ptr);
1879718799
ZVAL_COPY_VALUE(return_value, retval_ptr);
1879818800
if (GC_MAY_LEAK(ref)) {
18801+
SAVE_OPLINE();
1879918802
gc_possible_root(ref);
1880018803
}
1880118804
ZVAL_NULL(retval_ptr);
@@ -21452,6 +21455,7 @@ static ZEND_VM_HOT ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_RETURN_SPEC_VAR_HA
2145221455
zend_refcounted *ref = Z_COUNTED_P(retval_ptr);
2145321456
ZVAL_COPY_VALUE(return_value, retval_ptr);
2145421457
if (GC_MAY_LEAK(ref)) {
21458+
SAVE_OPLINE();
2145521459
gc_possible_root(ref);
2145621460
}
2145721461
ZVAL_NULL(retval_ptr);
@@ -38320,6 +38324,7 @@ static ZEND_VM_HOT ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_RETURN_SPEC_CV_HAN
3832038324
zend_refcounted *ref = Z_COUNTED_P(retval_ptr);
3832138325
ZVAL_COPY_VALUE(return_value, retval_ptr);
3832238326
if (GC_MAY_LEAK(ref)) {
38327+
SAVE_OPLINE();
3832338328
gc_possible_root(ref);
3832438329
}
3832538330
ZVAL_NULL(retval_ptr);
@@ -43114,8 +43119,8 @@ static ZEND_VM_HOT ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_BIND_GLOBAL_SPEC_C
4311443119
zend_refcounted *garbage = Z_COUNTED_P(variable_ptr);
4311543120

4311643121
ZVAL_REF(variable_ptr, ref);
43122+
SAVE_OPLINE();
4311743123
if (GC_DELREF(garbage) == 0) {
43118-
SAVE_OPLINE();
4311943124
rc_dtor_func(garbage);
4312043125
if (UNEXPECTED(EG(exception))) {
4312143126
ZVAL_NULL(variable_ptr);
@@ -56002,6 +56007,7 @@ ZEND_API void execute_ex(zend_execute_data *ex)
5600256007
zend_refcounted *ref = Z_COUNTED_P(retval_ptr);
5600356008
ZVAL_COPY_VALUE(return_value, retval_ptr);
5600456009
if (GC_MAY_LEAK(ref)) {
56010+
SAVE_OPLINE();
5600556011
gc_possible_root(ref);
5600656012
}
5600756013
ZVAL_NULL(retval_ptr);
@@ -56080,6 +56086,7 @@ ZEND_API void execute_ex(zend_execute_data *ex)
5608056086
zend_refcounted *ref = Z_COUNTED_P(retval_ptr);
5608156087
ZVAL_COPY_VALUE(return_value, retval_ptr);
5608256088
if (GC_MAY_LEAK(ref)) {
56089+
SAVE_OPLINE();
5608356090
gc_possible_root(ref);
5608456091
}
5608556092
ZVAL_NULL(retval_ptr);
@@ -57613,6 +57620,7 @@ ZEND_API void execute_ex(zend_execute_data *ex)
5761357620
zend_refcounted *ref = Z_COUNTED_P(retval_ptr);
5761457621
ZVAL_COPY_VALUE(return_value, retval_ptr);
5761557622
if (GC_MAY_LEAK(ref)) {
57623+
SAVE_OPLINE();
5761657624
gc_possible_root(ref);
5761757625
}
5761857626
ZVAL_NULL(retval_ptr);
@@ -57918,6 +57926,7 @@ ZEND_API void execute_ex(zend_execute_data *ex)
5791857926
zend_refcounted *ref = Z_COUNTED_P(retval_ptr);
5791957927
ZVAL_COPY_VALUE(return_value, retval_ptr);
5792057928
if (GC_MAY_LEAK(ref)) {
57929+
SAVE_OPLINE();
5792157930
gc_possible_root(ref);
5792257931
}
5792357932
ZVAL_NULL(retval_ptr);
@@ -59051,6 +59060,7 @@ ZEND_API void execute_ex(zend_execute_data *ex)
5905159060
zend_refcounted *ref = Z_COUNTED_P(retval_ptr);
5905259061
ZVAL_COPY_VALUE(return_value, retval_ptr);
5905359062
if (GC_MAY_LEAK(ref)) {
59063+
SAVE_OPLINE();
5905459064
gc_possible_root(ref);
5905559065
}
5905659066
ZVAL_NULL(retval_ptr);

‎ext/dom/node.c

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
#endif
2121

2222
#include "php.h"
23+
2324
#if defined(HAVE_LIBXML) && defined(HAVE_DOM)
2425
#include "php_dom.h"
2526

@@ -1003,6 +1004,7 @@ PHP_METHOD(DOMNode, replaceChild)
10031004
xmlNodePtr newchild, oldchild, nodep;
10041005
dom_object *intern, *newchildobj, *oldchildobj;
10051006
int stricterror;
1007+
bool replacedoctype = false;
10061008

10071009
int ret;
10081010

@@ -1042,7 +1044,51 @@ PHP_METHOD(DOMNode, replaceChild)
10421044
RETURN_FALSE;
10431045
}
10441046

1047+
<<<<<<< HEAD
10451048
if (oldchild->parent != nodep) {
1049+
=======
1050+
/* check for the old child and whether the new child is already a child */
1051+
while (children) {
1052+
if (children == oldchild) {
1053+
foundoldchild = 1;
1054+
break;
1055+
}
1056+
children = children->next;
1057+
}
1058+
1059+
if (foundoldchild) {
1060+
if (newchild->type == XML_DOCUMENT_FRAG_NODE) {
1061+
xmlNodePtr prevsib, nextsib;
1062+
prevsib = oldchild->prev;
1063+
nextsib = oldchild->next;
1064+
1065+
xmlUnlinkNode(oldchild);
1066+
1067+
newchild = _php_dom_insert_fragment(nodep, prevsib, nextsib, newchild, intern, newchildobj);
1068+
if (newchild) {
1069+
dom_reconcile_ns(nodep->doc, newchild);
1070+
}
1071+
} else if (oldchild != newchild) {
1072+
xmlDtdPtr intSubset = xmlGetIntSubset(nodep->doc);
1073+
replacedoctype = (intSubset == (xmlDtd *) oldchild);
1074+
1075+
if (newchild->doc == NULL && nodep->doc != NULL) {
1076+
xmlSetTreeDoc(newchild, nodep->doc);
1077+
newchildobj->document = intern->document;
1078+
php_libxml_increment_doc_ref((php_libxml_node_object *)newchildobj, NULL);
1079+
}
1080+
1081+
xmlReplaceNode(oldchild, newchild);
1082+
dom_reconcile_ns(nodep->doc, newchild);
1083+
1084+
if (replacedoctype) {
1085+
nodep->doc->intSubset = (xmlDtd *) newchild;
1086+
}
1087+
}
1088+
DOM_RET_OBJ(oldchild, &ret, intern);
1089+
return;
1090+
} else {
1091+
>>>>>>> PHP-8.0
10461092
php_dom_throw_error(NOT_FOUND_ERR, stricterror);
10471093
RETURN_FALSE;
10481094
}

‎ext/dom/tests/bug79451.phpt

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
--TEST--
2+
Bug #79451 (Using DOMDocument->replaceChild on doctype causes double free)
3+
--SKIPIF--
4+
<?php require_once('skipif.inc'); ?>
5+
--FILE--
6+
<?php
7+
$dom = new \DOMDocument();
8+
$dom->loadHTML("<!DOCTYPE html><p>hello</p>");
9+
$impl = new \DOMImplementation();
10+
$dt = $impl->createDocumentType("html_replace", "", "");
11+
$dom->replaceChild($dt, $dom->doctype);
12+
13+
var_dump($dom->doctype->name);
14+
echo $dom->saveXML();
15+
?>
16+
--EXPECTF--
17+
string(12) "html_replace"
18+
<?xml version="1.0" standalone="yes"?>
19+
<!DOCTYPE html_replace>
20+
<html><body><p>hello</p></body></html>

0 commit comments

Comments
 (0)