Skip to content

Commit fa825cb

Browse files
alexandre-dauboisalexandre-daubois
committed
Merge branch 'PHP-8.4' into PHP-8.5
* PHP-8.4: lexbor: Merge upstream memory safety fixes 8a14bc0 and f67ce4b
2 parents 2f0362e + 5982cda commit fa825cb

16 files changed

Lines changed: 198 additions & 17 deletions

‎NEWS‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,11 @@ PHP NEWS
2020
. Fixed a crash when converting with a cloned UConverter that uses
2121
toUCallback/fromUCallback. (Ilia Alshanetsky)
2222

23+
- Lexbor:
24+
. Merge patches 8a14bc0 and f67ce4b, fixing a heap buffer overflow in
25+
:lexbor-contains() parsing and buffer overflows in malformed decode
26+
replay. (alexandre-daubois)
27+
2328
- MBString:
2429
. Fixed bug GH-23106 (mb_strpos() reads past the end of a haystack ending in
2530
a truncated UTF-8 sequence). (Lazizbek Ergashev)

‎ext/dom/tests/modern/css_selectors/lexbor_contains.phpt‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
--TEST--
2+
CSS Selectors - Pseudo classes: :lexbor-contains() with an argument longer than its string header
3+
--EXTENSIONS--
4+
dom
5+
--FILE--
6+
<?php
7+
8+
$dom = Dom\HTMLDocument::createFromString('<p>needle</p>', LIBXML_NOERROR);
9+
10+
var_dump($dom->querySelectorAll(':lexbor-contains("' . str_repeat('needle', 1024) . '")')->length);
11+
var_dump($dom->querySelectorAll(':lexbor-contains("needle")')->length);
12+
13+
?>
14+
--EXPECT--
15+
int(0)
16+
int(0)

‎ext/lexbor/lexbor/css/selectors/pseudo_state.c‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -227,13 +227,12 @@ lxb_css_selectors_state_pseudo_class_function_lexbor_contains(lxb_css_parser_t *
227227
contains->insensitive = false;
228228
str = &contains->str;
229229

230-
str->data = lexbor_mraw_alloc(parser->memory->mraw,
231-
sizeof(lexbor_str_t));
230+
str->data = lexbor_mraw_alloc(parser->memory->mraw, length + 1);
232231
if (str->data == NULL) {
233232
return lxb_css_parser_memory_fail(parser);
234233
}
235234

236-
memcpy(str->data, data, length + 1);
235+
memcpy(str->data, data, length);
237236

238237
str->length = length;
239238
str->data[length] = '\0';

‎ext/lexbor/lexbor/encoding/decode.c‎

Lines changed: 33 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -912,6 +912,13 @@ lxb_encoding_decode_iso_2022_jp(lxb_encoding_decode_t *ctx,
912912
}
913913
LXB_ENCODING_DECODE_ERROR_END();
914914

915+
if (ctx->buffer_used >= ctx->buffer_length) {
916+
iso->prepand = iso->lead;
917+
iso->lead = 0x00;
918+
919+
return LXB_STATUS_SMALL_BUFFER;
920+
}
921+
915922
byte = iso->lead;
916923
iso->lead = 0x00;
917924

@@ -1279,6 +1286,12 @@ lxb_encoding_decode_utf_16(lxb_encoding_decode_t *ctx, bool is_be,
12791286
}
12801287
LXB_ENCODING_DECODE_ERROR_END();
12811288

1289+
if (ctx->buffer_used >= ctx->buffer_length) {
1290+
ctx->u.lead = lead + 0x01;
1291+
1292+
return LXB_STATUS_SMALL_BUFFER;
1293+
}
1294+
12821295
goto lead_state;
12831296
}
12841297

@@ -1723,6 +1736,13 @@ lxb_encoding_decode_gb18030(lxb_encoding_decode_t *ctx,
17231736
}
17241737
LXB_ENCODING_DECODE_ERROR_END();
17251738

1739+
if (ctx->buffer_used >= ctx->buffer_length) {
1740+
ctx->prepend = true;
1741+
ctx->u.gb18030.first = second;
1742+
1743+
return LXB_STATUS_SMALL_BUFFER;
1744+
}
1745+
17261746
first = second;
17271747

17281748
goto prepend_first;
@@ -1756,11 +1776,8 @@ lxb_encoding_decode_gb18030(lxb_encoding_decode_t *ctx,
17561776
}
17571777
LXB_ENCODING_DECODE_ERROR_END();
17581778

1759-
LXB_ENCODING_DECODE_APPEND_WO_CHECK(ctx, second);
1760-
1761-
if (ctx->buffer_used == ctx->buffer_length) {
1779+
if (ctx->buffer_used >= ctx->buffer_length) {
17621780
ctx->prepend = true;
1763-
ctx->have_error = true;
17641781

17651782
/* First is a fake for trigger */
17661783
ctx->u.gb18030.first = 0x01;
@@ -1770,6 +1787,18 @@ lxb_encoding_decode_gb18030(lxb_encoding_decode_t *ctx,
17701787
return LXB_STATUS_SMALL_BUFFER;
17711788
}
17721789

1790+
LXB_ENCODING_DECODE_APPEND_WO_CHECK(ctx, second);
1791+
1792+
if (ctx->buffer_used >= ctx->buffer_length) {
1793+
ctx->prepend = true;
1794+
1795+
ctx->u.gb18030.first = third;
1796+
ctx->u.gb18030.second = 0x00;
1797+
ctx->u.gb18030.third = 0x00;
1798+
1799+
return LXB_STATUS_SMALL_BUFFER;
1800+
}
1801+
17731802
first = third;
17741803

17751804
goto prepend_first;

‎ext/lexbor/patches/0001-Expose-line-and-column-information-for-use-in-PHP.patch‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
22
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
33
Date: Sat, 26 Aug 2023 15:08:59 +0200
4-
Subject: [PATCH 01/10] Expose line and column information for use in PHP
4+
Subject: [PATCH 01/12] Expose line and column information for use in PHP
55

66
---
77
source/lexbor/dom/interfaces/node.h | 2 ++

‎ext/lexbor/patches/0002-Track-implied-added-nodes-for-options-use-in-PHP.patch‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
22
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
33
Date: Mon, 14 Aug 2023 20:18:51 +0200
4-
Subject: [PATCH 02/10] Track implied added nodes for options use in PHP
4+
Subject: [PATCH 02/12] Track implied added nodes for options use in PHP
55

66
---
77
source/lexbor/html/tree.h | 3 +++

‎ext/lexbor/patches/0003-Patch-utilities-and-data-structure-to-be-able-to-gen.patch‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
22
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
33
Date: Thu, 24 Aug 2023 22:57:48 +0200
4-
Subject: [PATCH 03/10] Patch utilities and data structure to be able to
4+
Subject: [PATCH 03/12] Patch utilities and data structure to be able to
55
generate smaller lookup tables
66

77
Changed the generation script to check if everything fits in 32-bits.

‎ext/lexbor/patches/0004-Remove-unused-upper-case-tag-static-data.patch‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
22
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
33
Date: Wed, 29 Nov 2023 21:26:47 +0100
4-
Subject: [PATCH 04/10] Remove unused upper case tag static data
4+
Subject: [PATCH 04/12] Remove unused upper case tag static data
55

66
---
77
source/lexbor/tag/res.h | 2 ++

‎ext/lexbor/patches/0005-Shrink-size-of-static-binary-search-tree.patch‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
22
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
33
Date: Wed, 29 Nov 2023 21:29:31 +0100
4-
Subject: [PATCH 05/10] Shrink size of static binary search tree
4+
Subject: [PATCH 05/12] Shrink size of static binary search tree
55

66
This also makes it more efficient on the data cache.
77
---

‎ext/lexbor/patches/0006-Patch-out-unused-CSS-style-code.patch‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
22
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
33
Date: Sun, 7 Jan 2024 21:59:28 +0100
4-
Subject: [PATCH 06/10] Patch out unused CSS style code
4+
Subject: [PATCH 06/12] Patch out unused CSS style code
55

66
---
77
source/lexbor/css/rule.h | 2 ++

0 commit comments

Comments
 (0)