Skip to content

Commit 30662e4

Browse files
committed
Merge branch 'PHP-8.4'
* PHP-8.4: Fix GH-18979: DOM\XMLDocument::createComment() triggers undefined behavior with null byte
2 parents 50e1b23 + 1d5089e commit 30662e4

File tree

2 files changed

+18
-1
lines changed

2 files changed

+18
-1
lines changed

ext/dom/tests/modern/xml/gh18979.phpt

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
--TEST--
2+
GH-18979 (DOM\XMLDocument::createComment() triggers undefined behavior with null byte)
3+
--EXTENSIONS--
4+
dom
5+
--FILE--
6+
<?php
7+
$dom = Dom\XMLDocument::createEmpty();
8+
$container = $dom->createElement("container");
9+
$container->append($dom->createComment("\0"));
10+
var_dump($container->innerHTML);
11+
?>
12+
--EXPECT--
13+
string(7) "<!---->"

ext/dom/xml_serializer.c

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -640,7 +640,11 @@ static int dom_xml_serialize_comment_node(xmlOutputBufferPtr out, xmlNodePtr com
640640
const xmlChar *ptr = comment->content;
641641
if (ptr != NULL) {
642642
TRY(dom_xml_check_char_production(ptr));
643-
if (strstr((const char *) ptr, "--") != NULL || ptr[strlen((const char *) ptr) - 1] == '-') {
643+
if (strstr((const char *) ptr, "--") != NULL) {
644+
return -1;
645+
}
646+
size_t len = strlen((const char *) ptr);
647+
if (len > 0 && ptr[len - 1] == '-') {
644648
return -1;
645649
}
646650
}

0 commit comments

Comments
 (0)