Skip to content

Commit 8fc52d7

Browse files
smalyshevTyrael
smalyshev
authored and
Tyrael
committed
Fix #69719 - more checks for nulls in paths
1 parent 07fb924 commit 8fc52d7

File tree

2 files changed

+24
-12
lines changed

2 files changed

+24
-12
lines changed

‎ext/dom/document.c

Lines changed: 17 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1700,7 +1700,7 @@ PHP_FUNCTION(dom_document_save)
17001700
char *file;
17011701
long options = 0;
17021702

1703-
if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Os|l", &id, dom_document_class_entry, &file, &file_len, &options) == FAILURE) {
1703+
if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Op|l", &id, dom_document_class_entry, &file, &file_len, &options) == FAILURE) {
17041704
return;
17051705
}
17061706

@@ -1930,7 +1930,7 @@ static void _dom_document_schema_validate(INTERNAL_FUNCTION_PARAMETERS, int type
19301930
int is_valid;
19311931
char resolved_path[MAXPATHLEN + 1];
19321932

1933-
if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Op|l", &id, dom_document_class_entry, &source, &source_len, &flags) == FAILURE) {
1933+
if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Os|l", &id, dom_document_class_entry, &source, &source_len, &flags) == FAILURE) {
19341934
return;
19351935
}
19361936

@@ -1943,6 +1943,10 @@ static void _dom_document_schema_validate(INTERNAL_FUNCTION_PARAMETERS, int type
19431943

19441944
switch (type) {
19451945
case DOM_LOAD_FILE:
1946+
if (CHECK_NULL_PATH(source, source_len)) {
1947+
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid Schema file source");
1948+
RETURN_FALSE;
1949+
}
19461950
valid_file = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN TSRMLS_CC);
19471951
if (!valid_file) {
19481952
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid Schema file source");
@@ -2026,7 +2030,7 @@ static void _dom_document_relaxNG_validate(INTERNAL_FUNCTION_PARAMETERS, int typ
20262030
int is_valid;
20272031
char resolved_path[MAXPATHLEN + 1];
20282032

2029-
if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Op", &id, dom_document_class_entry, &source, &source_len) == FAILURE) {
2033+
if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Os", &id, dom_document_class_entry, &source, &source_len) == FAILURE) {
20302034
return;
20312035
}
20322036

@@ -2039,6 +2043,10 @@ static void _dom_document_relaxNG_validate(INTERNAL_FUNCTION_PARAMETERS, int typ
20392043

20402044
switch (type) {
20412045
case DOM_LOAD_FILE:
2046+
if (CHECK_NULL_PATH(source, source_len)) {
2047+
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid RelaxNG file source");
2048+
RETURN_FALSE;
2049+
}
20422050
valid_file = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN TSRMLS_CC);
20432051
if (!valid_file) {
20442052
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid RelaxNG file source");
@@ -2119,7 +2127,7 @@ static void dom_load_html(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */
21192127

21202128
id = getThis();
21212129

2122-
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|l", &source, &source_len, &options) == FAILURE) {
2130+
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|l", &source, &source_len, &options) == FAILURE) {
21232131
return;
21242132
}
21252133

@@ -2129,6 +2137,10 @@ static void dom_load_html(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */
21292137
}
21302138

21312139
if (mode == DOM_LOAD_FILE) {
2140+
if (CHECK_NULL_PATH(source, source_len)) {
2141+
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid file source");
2142+
RETURN_FALSE;
2143+
}
21322144
ctxt = htmlCreateFileParserCtxt(source, NULL);
21332145
} else {
21342146
source_len = xmlStrlen(source);
@@ -2217,7 +2229,7 @@ PHP_FUNCTION(dom_document_save_html_file)
22172229
char *file;
22182230
const char *encoding;
22192231

2220-
if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Os", &id, dom_document_class_entry, &file, &file_len) == FAILURE) {
2232+
if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Op", &id, dom_document_class_entry, &file, &file_len) == FAILURE) {
22212233
return;
22222234
}
22232235

‎ext/gd/gd.c

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1750,7 +1750,7 @@ PHP_FUNCTION(imagefilledarc)
17501750
long cx, cy, w, h, ST, E, col, style;
17511751
gdImagePtr im;
17521752
int e, st;
1753-
1753+
17541754
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rllllllll", &IM, &cx, &cy, &w, &h, &ST, &E, &col, &style) == FAILURE) {
17551755
return;
17561756
}
@@ -1991,7 +1991,7 @@ PHP_FUNCTION(imagegrabwindow)
19911991
if ( handle == 0 ) {
19921992
goto clean;
19931993
}
1994-
pPrintWindow = (tPrintWindow) GetProcAddress(handle, "PrintWindow");
1994+
pPrintWindow = (tPrintWindow) GetProcAddress(handle, "PrintWindow");
19951995

19961996
if ( pPrintWindow ) {
19971997
pPrintWindow(window, memDC, (UINT) client_area);
@@ -3860,7 +3860,7 @@ static void php_imagettftext_common(INTERNAL_FUNCTION_PARAMETERS, int mode, int
38603860
if (zend_hash_get_current_data_ex(HASH_OF(EXT), (void **) &item, &pos) == FAILURE) {
38613861
continue;
38623862
}
3863-
3863+
38643864
if (strcmp("linespacing", key) == 0) {
38653865
convert_to_double_ex(item);
38663866
strex.flags |= gdFTEX_LINESPACE;
@@ -3939,7 +3939,7 @@ PHP_FUNCTION(imagepsloadfont)
39393939
struct stat st;
39403940
#endif
39413941

3942-
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &file, &file_len) == FAILURE) {
3942+
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &file, &file_len) == FAILURE) {
39433943
return;
39443944
}
39453945

@@ -4279,11 +4279,11 @@ PHP_FUNCTION(imagepsbbox)
42794279
if (argc != 3 && argc != 6) {
42804280
ZEND_WRONG_PARAM_COUNT();
42814281
}
4282-
4282+
42834283
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "srl|lld", &str, &str_len, &fnt, &sz, &sp, &wd, &angle) == FAILURE) {
42844284
return;
42854285
}
4286-
4286+
42874287
if (argc == 6) {
42884288
space = sp;
42894289
add_width = wd;
@@ -4459,7 +4459,7 @@ static void _php_image_convert(INTERNAL_FUNCTION_PARAMETERS, int image_type )
44594459
int x, y;
44604460
float x_ratio, y_ratio;
44614461
long ignore_warning;
4462-
4462+
44634463
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "pplll", &f_org, &f_org_len, &f_dest, &f_dest_len, &height, &width, &threshold) == FAILURE) {
44644464
return;
44654465
}

0 commit comments

Comments
 (0)