diff options
| -rw-r--r-- | NEWS | 3 | ||||
| -rw-r--r-- | ext/xml/tests/bug79922.phpt | 17 | ||||
| -rw-r--r-- | ext/xml/xml.c | 4 |
3 files changed, 22 insertions, 2 deletions
@@ -27,6 +27,9 @@ PHP NEWS . Fixed bug #79930 (array_merge_recursive() crashes when called with array with single reference). (Nikita) +- XML: + . Fixed bug #79922 (Crash after multiple calls to xml_parser_free()). (cmb) + 06 Aug 2020, PHP 7.3.21 - Apache: diff --git a/ext/xml/tests/bug79922.phpt b/ext/xml/tests/bug79922.phpt new file mode 100644 index 0000000000..e578a5d2c4 --- /dev/null +++ b/ext/xml/tests/bug79922.phpt @@ -0,0 +1,17 @@ +--TEST-- +Bug #79922 (Crash after multiple calls to xml_parser_free()) +--SKIPIF-- +<?php +if (!extension_loaded('xml')) die('skip xml extension not available'); +?> +--FILE-- +<?php +$c=xml_parser_create_ns(); +$a=xml_parser_free($c); +$a=xml_parser_free($c); +$c=0; +var_dump($a); +?> +--EXPECTF-- +Warning: xml_parser_free(): supplied resource is not a valid XML Parser resource in %s on line %d +bool(false) diff --git a/ext/xml/xml.c b/ext/xml/xml.c index 8a5f7797ce..7ca0275595 100644 --- a/ext/xml/xml.c +++ b/ext/xml/xml.c @@ -1132,7 +1132,7 @@ static void php_xml_parser_create_impl(INTERNAL_FUNCTION_PARAMETERS, int ns_supp XML_SetUserData(parser->parser, parser); RETVAL_RES(zend_register_resource(parser, le_xml_parser)); - ZVAL_COPY(&parser->index, return_value); + ZVAL_COPY_VALUE(&parser->index, return_value); } /* }}} */ @@ -1559,7 +1559,7 @@ PHP_FUNCTION(xml_parser_free) RETURN_FALSE; } - if (zend_list_delete(Z_RES(parser->index)) == FAILURE) { + if (zend_list_close(Z_RES(parser->index)) == FAILURE) { RETURN_FALSE; } |