diff options
| author | Anatol Belski <ab@php.net> | 2015-08-25 17:54:27 +0200 |
|---|---|---|
| committer | Anatol Belski <ab@php.net> | 2015-08-26 16:39:50 +0200 |
| commit | 201afce875b90d3675ff2eedc8b8d74f1e62b2d1 (patch) | |
| tree | 3ca3432171ea36041754271cc608b06566a56e56 | |
| parent | a3dceb485a610808b30f17aae1d2d2ae6f5ccbb6 (diff) | |
| download | php-git-201afce875b90d3675ff2eedc8b8d74f1e62b2d1.tar.gz | |
add some range checks to ext/dom
| -rw-r--r-- | ext/dom/document.c | 21 |
1 files changed, 19 insertions, 2 deletions
diff --git a/ext/dom/document.c b/ext/dom/document.c index 64d3ca4ad6..6db61a3794 100644 --- a/ext/dom/document.c +++ b/ext/dom/document.c @@ -1493,6 +1493,14 @@ static void dom_parse_document(INTERNAL_FUNCTION_PARAMETERS, int mode) { php_error_docref(NULL, E_WARNING, "Empty string supplied as input"); RETURN_FALSE; } + if (ZEND_SIZE_T_INT_OVFL(source_len)) { + php_error_docref(NULL, E_WARNING, "Input string is too long"); + RETURN_FALSE; + } + if (ZEND_LONG_EXCEEDS_INT(options)) { + php_error_docref(NULL, E_WARNING, "Invalid options"); + RETURN_FALSE; + } newdoc = dom_document_parser(id, mode, source, source_len, options); @@ -2001,6 +2009,11 @@ static void dom_load_html(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */ RETURN_FALSE; } + if (ZEND_LONG_EXCEEDS_INT(options)) { + php_error_docref(NULL, E_WARNING, "Invalid options"); + RETURN_FALSE; + } + if (mode == DOM_LOAD_FILE) { if (CHECK_NULL_PATH(source, source_len)) { php_error_docref(NULL, E_WARNING, "Invalid file source"); @@ -2009,7 +2022,11 @@ static void dom_load_html(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */ ctxt = htmlCreateFileParserCtxt(source, NULL); } else { source_len = xmlStrlen((xmlChar *) source); - ctxt = htmlCreateMemoryParserCtxt(source, source_len); + if (ZEND_SIZE_T_INT_OVFL(source_len)) { + php_error_docref(NULL, E_WARNING, "Input string is too long"); + RETURN_FALSE; + } + ctxt = htmlCreateMemoryParserCtxt(source, (int)source_len); } if (!ctxt) { @@ -2017,7 +2034,7 @@ static void dom_load_html(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */ } if (options) { - htmlCtxtUseOptions(ctxt, options); + htmlCtxtUseOptions(ctxt, (int)options); } ctxt->vctxt.error = php_libxml_ctx_error; |