diff options
| author | Stanislav Malyshev <stas@php.net> | 2016-10-11 13:30:52 -0700 |
|---|---|---|
| committer | Anatol Belski <ab@php.net> | 2016-10-14 01:42:05 +0200 |
| commit | e7e60851ae2a3ce47a317b93e080e4daa7120934 (patch) | |
| tree | 534f5570023ca6ef959b8613680e3df50ec0a10e /ext/simplexml/simplexml.c | |
| parent | 8e2c9024a6755c092f80b385aa7b7487efdc8acc (diff) | |
| download | php-git-e7e60851ae2a3ce47a317b93e080e4daa7120934.tar.gz | |
Fix bug #73293 - NULL pointer dereference in SimpleXMLElement::asXML()
(cherry picked from commit 96a8cf8e1b5dc1b0c708bb5574e0d6727cc56d9e)
(cherry picked from commit 4ef79370a82d6c92f4ea0cd462274ba24e007f56)
Diffstat (limited to 'ext/simplexml/simplexml.c')
| -rw-r--r-- | ext/simplexml/simplexml.c | 19 |
1 files changed, 16 insertions, 3 deletions
diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c index fdda30451d..1f75052ed7 100644 --- a/ext/simplexml/simplexml.c +++ b/ext/simplexml/simplexml.c @@ -1474,9 +1474,15 @@ SXE_METHOD(asXML) if (node) { if (node->parent && (XML_DOCUMENT_NODE == node->parent->type)) { xmlDocDumpMemoryEnc((xmlDocPtr) sxe->document->ptr, &strval, &strval_len, (const char *) ((xmlDocPtr) sxe->document->ptr)->encoding); - RETVAL_STRINGL((char *)strval, strval_len); + if (!strval) { + RETVAL_FALSE; + } else { + RETVAL_STRINGL((char *)strval, strval_len); + } xmlFree(strval); } else { + char *return_content; + size_t return_len; /* Should we be passing encoding information instead of NULL? */ outbuf = xmlAllocOutputBuffer(NULL); @@ -1487,10 +1493,17 @@ SXE_METHOD(asXML) xmlNodeDumpOutput(outbuf, (xmlDocPtr) sxe->document->ptr, node, 0, 0, (const char *) ((xmlDocPtr) sxe->document->ptr)->encoding); xmlOutputBufferFlush(outbuf); #ifdef LIBXML2_NEW_BUFFER - RETVAL_STRINGL((char *)xmlOutputBufferGetContent(outbuf), xmlOutputBufferGetSize(outbuf)); + return_content = (char *)xmlOutputBufferGetContent(outbuf); + return_len = xmlOutputBufferGetSize(outbuf); #else - RETVAL_STRINGL((char *)outbuf->buffer->content, outbuf->buffer->use); + return_content = (char *)outbuf->buffer->content; + return_len = outbuf->buffer->use; #endif + if (return_content) { + RETVAL_FALSE; + } else { + RETVAL_STRINGL(return_content, return_len); + } xmlOutputBufferClose(outbuf); } } else { |