Merge branch 'PHP-8.3'

* PHP-8.3: Fix reference access in dimensions for DOMNodeList and DOMNodeMap
php · Feb 26, 2024 · ddcf5d7 · ddcf5d7
2 parents dbf0b6a + c5a63a9
commit ddcf5d7
Show file tree

Hide file tree

Showing 3 changed files with 98 additions and 25 deletions.
diff --git a/ext/dom/php_dom.c b/ext/dom/php_dom.c
@@ -1770,6 +1770,8 @@ static zval *dom_nodelist_read_dimension(zend_object *object, zval *offset, int
 		return NULL;
 	}
 
+	ZVAL_DEREF(offset);
+
 	zend_long lval;
 	if (dom_nodemap_or_nodelist_process_offset_as_named(offset, &lval)) {
 		/* does not support named lookup */
@@ -1783,6 +1785,8 @@ static zval *dom_nodelist_read_dimension(zend_object *object, zval *offset, int
 
 static int dom_nodelist_has_dimension(zend_object *object, zval *member, int check_empty)
 {
+	ZVAL_DEREF(member);
+
 	zend_long offset;
 	if (dom_nodemap_or_nodelist_process_offset_as_named(member, &offset)) {
 		/* does not support named lookup */
@@ -1842,6 +1846,8 @@ static zval *dom_nodemap_read_dimension(zend_object *object, zval *offset, int t
 		return NULL;
 	}
 
+	ZVAL_DEREF(offset);
+
 	zend_long lval;
 	if (dom_nodemap_or_nodelist_process_offset_as_named(offset, &lval)) {
 		/* exceptional case, switch to named lookup */
@@ -1861,6 +1867,8 @@ static zval *dom_nodemap_read_dimension(zend_object *object, zval *offset, int t
 
 static int dom_nodemap_has_dimension(zend_object *object, zval *member, int check_empty)
 {
+	ZVAL_DEREF(member);
+
 	zend_long offset;
 	if (dom_nodemap_or_nodelist_process_offset_as_named(member, &offset)) {
 		/* exceptional case, switch to named lookup */

diff --git a/ext/dom/tests/DOMNamedNodeMap_string_references.phpt b/ext/dom/tests/DOMNamedNodeMap_string_references.phpt
@@ -0,0 +1,64 @@
+--TEST--
+DOMNamedNodeMap string references
+--EXTENSIONS--
+dom
+--FILE--
+<?php
+
+$dom = new DOMDocument;
+$dom->loadXML('<a href="hi" foo="bar"/>');
+
+$attributes = $dom->documentElement->attributes;
+
+var_dump(isset($attributes['href']), $attributes['href']->value);
+
+var_dump(isset($attributes['foo']), $attributes['foo']->value);
+
+$str = 'href';
+$ref =& $str;
+var_dump(isset($attributes[$ref]), $attributes[$ref]->value);
+
+$str = 'foo';
+$ref =& $str;
+var_dump(isset($attributes[$ref]), $attributes[$ref]->value);
+
+$str = 'this does not exist';
+$ref =& $str;
+var_dump(isset($attributes[$ref]), $attributes[$ref]);
+
+$str = '0';
+$ref =& $str;
+var_dump(isset($attributes[$ref]), $attributes[$ref]->value);
+
+$str = '1';
+$ref =& $str;
+var_dump(isset($attributes[$ref]), $attributes[$ref]->value);
+
+$int = 0;
+$ref =& $int;
+var_dump(isset($attributes[$ref]), $attributes[$ref]->value);
+
+$int = 1;
+$ref =& $int;
+var_dump(isset($attributes[$ref]), $attributes[$ref]->value);
+
+?>
+--EXPECT--
+bool(true)
+string(2) "hi"
+bool(true)
+string(3) "bar"
+bool(true)
+string(2) "hi"
+bool(true)
+string(3) "bar"
+bool(false)
+NULL
+bool(true)
+string(2) "hi"
+bool(true)
+string(3) "bar"
+bool(true)
+string(2) "hi"
+bool(true)
+string(3) "bar"
diff --git a/ext/dom/tests/bug67949.phpt b/ext/dom/tests/bug67949.phpt
@@ -5,6 +5,8 @@ dom
 --FILE--
 <?php
 
+// Note: non-numeric string accesses fail on NodeLists (as per spec).
+
 $html = <<<HTML
 <div>data</div>
 <a href="test">hello world</a>
@@ -14,57 +16,56 @@ $doc->loadHTML($html);
 
 $nodes = $doc->getElementsByTagName('div');
 
-echo "testing has_dimension\n";
+echo "--- testing has_dimension ---\n";
 var_dump(isset($nodes[0]));
 var_dump(isset($nodes[1]));
 var_dump(isset($nodes[-1]));
 
-echo "testing property access\n";
+echo "--- testing property access ---\n";
 var_dump($nodes[0]->textContent);
 var_dump($nodes[1]->textContent);
 
-echo "testing offset not a long\n";
+echo "--- testing offset not a long: array ---\n";
 $offset = ['test'];
 var_dump($offset);
 var_dump(isset($nodes[$offset]), $nodes[$offset]->textContent);
-var_dump($offset);
 
-$something = 'test';
+echo "--- testing offset not a long: Reference to string ---\n";
+$something = 'href';
 $offset = &$something;
 
 var_dump($offset);
 var_dump(isset($nodes[$offset]), $nodes[$offset]->textContent);
-var_dump($offset);
 
+echo "--- testing offset not a long: string ---\n";
 $offset = 'test';
 var_dump($offset);
 var_dump(isset($nodes[$offset]), $nodes[$offset]->textContent);
-var_dump($offset);
 
-echo "testing read_dimension with null offset\n";
+echo "--- testing read_dimension with null offset ---\n";
 try {
     var_dump($nodes[][] = 1);
 } catch (Error $e) {
     echo $e->getMessage(), "\n";
 }
 
-echo "testing attribute access\n";
+echo "--- testing attribute access ---\n";
 $anchor = $doc->getElementsByTagName('a')[0];
 var_dump($anchor->attributes[0]->name);
 
 echo "==DONE==\n";
 ?>
 --EXPECTF--
-testing has_dimension
+--- testing has_dimension ---
 bool(true)
 bool(false)
 bool(false)
-testing property access
+--- testing property access ---
 string(4) "data"
 
 Warning: Attempt to read property "textContent" on null in %s on line %d
 NULL
-testing offset not a long
+--- testing offset not a long: array ---
 array(1) {
   [0]=>
   string(4) "test"
@@ -73,20 +74,20 @@ array(1) {
 Warning: Attempt to read property "textContent" on null in %s on line %d
 bool(false)
 NULL
-array(1) {
-  [0]=>
-  string(4) "test"
-}
-string(4) "test"
-bool(true)
-string(4) "data"
-string(4) "test"
-string(4) "test"
-bool(true)
-string(4) "data"
+--- testing offset not a long: Reference to string ---
+string(4) "href"
+
+Warning: Attempt to read property "textContent" on null in %s on line %d
+bool(false)
+NULL
+--- testing offset not a long: string ---
 string(4) "test"
-testing read_dimension with null offset
+
+Warning: Attempt to read property "textContent" on null in %s on line %d
+bool(false)
+NULL
+--- testing read_dimension with null offset ---
 Cannot access DOMNodeList without offset
-testing attribute access
+--- testing attribute access ---
 string(4) "href"
 ==DONE==