PHP 5.3.27

NEWS

@@ -1,6 +1,6 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2013, PHP 5.3.27
+11 Jul 2013, PHP 5.3.27
 
 - Core:
   . Fixed bug #64966 (segfault in zend_do_fcall_common_helper_SPEC). (Laruence)
@@ -28,6 +28,9 @@ PHP                                                                        NEWS
   . Fixed bug #64997 (Segfault while using RecursiveIteratorIterator on 
     64-bits systems). (Laruence)
 
+- XML:
+  . Fixed bug #65236 (heap corruption in xml parser). (Rob)
+
 06 Jun 2013, PHP 5.3.26
 
 - Core:

Zend/zend_alloc.c

@@ -2386,7 +2386,7 @@ static inline size_t safe_address(size_t nmemb, size_t size, size_t offset)
 	size_t res = nmemb;
 	unsigned long overflow = 0;
 
-	__asm__ ("mull %3\n\taddl %4,%0\n\tadcl %1,%1"
+	__asm__ ("mull %3\n\taddl %4,%0\n\tadcl $0,%1"
 	     : "=&a"(res), "=&d" (overflow)
 	     : "%0"(res),
 	       "rm"(size),
@@ -2406,7 +2406,7 @@ static inline size_t safe_address(size_t nmemb, size_t size, size_t offset)
         size_t res = nmemb;
         unsigned long overflow = 0;
 
-        __asm__ ("mulq %3\n\taddq %4,%0\n\tadcq %1,%1"
+        __asm__ ("mulq %3\n\taddq %4,%0\n\tadcq $0,%1"
              : "=&a"(res), "=&d" (overflow)
              : "%0"(res),
                "rm"(size),

configure.in

@@ -42,7 +42,7 @@ AC_CONFIG_HEADER(main/php_config.h)
 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=3
 PHP_RELEASE_VERSION=27
-PHP_EXTRA_VERSION="-dev"
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
 

ext/xml/tests/bug65236.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Bug #65236 (heap corruption in xml parser)
+--SKIPIF--
+<?php
+require_once("skipif.inc");
+?>
+--FILE--
+<?php
+xml_parse_into_struct(xml_parser_create_ns(), str_repeat("<blah>", 1000), $a);
+
+echo "Done\n";
+?>
+--EXPECTF--
+Warning: xml_parse_into_struct(): Maximum depth exceeded - Results truncated in %s on line %d
+Done

ext/xml/xml.c

@@ -427,7 +427,7 @@ static void xml_parser_dtor(zend_rsrc_list_entry *rsrc TSRMLS_DC)
 	}
 	if (parser->ltags) {
 		int inx;
-		for (inx = 0; inx < parser->level; inx++)
+		for (inx = 0; ((inx < parser->level) && (inx < XML_MAXLEVEL)); inx++)
 			efree(parser->ltags[ inx ]);
 		efree(parser->ltags);
 	}
@@ -905,45 +905,50 @@ void _xml_startElementHandler(void *userData, const XML_Char *name, const XML_Ch
 		} 
 
 		if (parser->data) {
-			zval *tag, *atr;
-			int atcnt = 0;
+			if (parser->level <= XML_MAXLEVEL)  {
+				zval *tag, *atr;
+				int atcnt = 0;
 
-			MAKE_STD_ZVAL(tag);
-			MAKE_STD_ZVAL(atr);
+				MAKE_STD_ZVAL(tag);
+				MAKE_STD_ZVAL(atr);
 
-			array_init(tag);
-			array_init(atr);
+				array_init(tag);
+				array_init(atr);
 
-			_xml_add_to_info(parser,((char *) tag_name) + parser->toffset);
+				_xml_add_to_info(parser,((char *) tag_name) + parser->toffset);
 
-			add_assoc_string(tag,"tag",((char *) tag_name) + parser->toffset,1); /* cast to avoid gcc-warning */
-			add_assoc_string(tag,"type","open",1);
-			add_assoc_long(tag,"level",parser->level);
+				add_assoc_string(tag,"tag",((char *) tag_name) + parser->toffset,1); /* cast to avoid gcc-warning */
+				add_assoc_string(tag,"type","open",1);
+				add_assoc_long(tag,"level",parser->level);
 
-			parser->ltags[parser->level-1] = estrdup(tag_name);
-			parser->lastwasopen = 1;
+				parser->ltags[parser->level-1] = estrdup(tag_name);
+				parser->lastwasopen = 1;
 
-			attributes = (const XML_Char **) attrs;
+				attributes = (const XML_Char **) attrs;
 
-			while (attributes && *attributes) {
-				att = _xml_decode_tag(parser, attributes[0]);
-				val = xml_utf8_decode(attributes[1], strlen(attributes[1]), &val_len, parser->target_encoding);
-				
-				add_assoc_stringl(atr,att,val,val_len,0);
+				while (attributes && *attributes) {
+					att = _xml_decode_tag(parser, attributes[0]);
+					val = xml_utf8_decode(attributes[1], strlen(attributes[1]), &val_len, parser->target_encoding);
 
-				atcnt++;
-				attributes += 2;
+					add_assoc_stringl(atr,att,val,val_len,0);
 
-				efree(att);
+					atcnt++;
+					attributes += 2;
+
+					efree(att);
+				}
+
+				if (atcnt) {
+					zend_hash_add(Z_ARRVAL_P(tag),"attributes",sizeof("attributes"),&atr,sizeof(zval*),NULL);
+				} else {
+					zval_ptr_dtor(&atr);
+				}
+
+				zend_hash_next_index_insert(Z_ARRVAL_P(parser->data),&tag,sizeof(zval*),(void *) &parser->ctag);
+			} else if (parser->level == (XML_MAXLEVEL + 1)) {
+				TSRMLS_FETCH();
+				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Maximum depth exceeded - Results truncated");
 			}
-
-			if (atcnt) {
-				zend_hash_add(Z_ARRVAL_P(tag),"attributes",sizeof("attributes"),&atr,sizeof(zval*),NULL);
-			} else {
-				zval_ptr_dtor(&atr);
-			}
-
-			zend_hash_next_index_insert(Z_ARRVAL_P(parser->data),&tag,sizeof(zval*),(void *) &parser->ctag);
 		}
 
 		efree(tag_name);
@@ -995,7 +1000,7 @@ void _xml_endElementHandler(void *userData, const XML_Char *name)
 
 		efree(tag_name);
 
-		if (parser->ltags) {
+		if ((parser->ltags) && (parser->level <= XML_MAXLEVEL)) {
 			efree(parser->ltags[parser->level-1]);
 		}
 
@@ -1079,18 +1084,23 @@ void _xml_characterDataHandler(void *userData, const XML_Char *s, int len)
 						}
 					}
 
-					MAKE_STD_ZVAL(tag);
-					
-					array_init(tag);
-					
-					_xml_add_to_info(parser,parser->ltags[parser->level-1] + parser->toffset);
+					if (parser->level <= XML_MAXLEVEL) {
+						MAKE_STD_ZVAL(tag);
 
-					add_assoc_string(tag,"tag",parser->ltags[parser->level-1] + parser->toffset,1);
-					add_assoc_string(tag,"value",decoded_value,0);
-					add_assoc_string(tag,"type","cdata",1);
-					add_assoc_long(tag,"level",parser->level);
+						array_init(tag);
 
-					zend_hash_next_index_insert(Z_ARRVAL_P(parser->data),&tag,sizeof(zval*),NULL);
+						_xml_add_to_info(parser,parser->ltags[parser->level-1] + parser->toffset);
+
+						add_assoc_string(tag,"tag",parser->ltags[parser->level-1] + parser->toffset,1);
+						add_assoc_string(tag,"value",decoded_value,0);
+						add_assoc_string(tag,"type","cdata",1);
+						add_assoc_long(tag,"level",parser->level);
+
+						zend_hash_next_index_insert(Z_ARRVAL_P(parser->data),&tag,sizeof(zval*),NULL);
+					} else if (parser->level == (XML_MAXLEVEL + 1)) {
+						TSRMLS_FETCH();
+						php_error_docref(NULL TSRMLS_CC, E_WARNING, "Maximum depth exceeded - Results truncated");
+					}
 				}
 			} else {
 				efree(decoded_value);

main/php_version.h

@@ -3,6 +3,6 @@
 #define PHP_MAJOR_VERSION 5
 #define PHP_MINOR_VERSION 3
 #define PHP_RELEASE_VERSION 27
-#define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "5.3.27-dev"
+#define PHP_EXTRA_VERSION ""
+#define PHP_VERSION "5.3.27"
 #define PHP_VERSION_ID 50327