|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2011-05-07 01:13 UTC] cxib at securityreason dot com
Description:
------------
class tidy, may provide to null pointer dereference using tidy lib.
1287 static PHP_FUNCTION(tidy_diagnose)
1288 {
1289 TIDY_FETCH_OBJECT;
1290
1291 if (tidyRunDiagnostics(obj->ptdoc->doc) >= 0) {
1292 tidy_doc_update_properties(obj TSRMLS_CC);
1293 RETURN_TRUE;
1294 }
1295
1296 RETURN_FALSE;
1297 }
Test script:
---------------
(gdb) r -r '$nx=new Tidy("*");$nx->diagnose();'
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /usr/bin/php -r '$nx=new Tidy("*");$nx->diagnose();'
[Thread debugging using libthread_db enabled]
PHP Warning: tidy::__construct(): Cannot Load '*' into memory in Command line code on line 1
Program received signal SIGSEGV, Segmentation fault.
0x00007fffedfaff87 in prvTidyReportMarkupVersion ()
from /usr/lib/libtidy-0.99.so.0
Actual result:
--------------
cx@cx64:~$ php -r '$nx=new Tidy("*");$nx->diagnose();'
PHP Warning: tidy::__construct(): Cannot Load '*' into memory in Command line code on line 1
Segmentation fault
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Fri Oct 24 13:00:02 2025 UTC |
hymm.. just changing if (tidyRunDiagnostics(obj->ptdoc->doc) >= 0) { to if (tidyStatus(obj->ptdoc->doc)!=0 && tidyRunDiagnostics(obj->ptdoc->doc) >= 0) { ? for 540rc1, fix works well is tidyStatus() correct function here?I guess it's ok to got with this approach. 743 int TIDY_CALL tidyStatus( TidyDoc tdoc ) 744 { 745 TidyDocImpl* impl = tidyDocToImpl( tdoc ); 746 int tidyStat = -EINVAL; 747 if ( impl ) 748 tidyStat = tidyDocStatus( impl ); 749 return tidyStat; 750 } 1117 int tidyDocStatus( TidyDocImpl* doc ) 1118 { 1119 if ( doc->errors > 0 ) 1120 return 2; 1121 if ( doc->warnings > 0 || doc->accessErrors > 0 ) 1122 return 1; 1123 return 0; 1124 }Reopening since this patch made a regression. e.g. <?php $t = new tidy('foo.html'); $t->cleanRepair(); var_dump($t->diagnose()); ?> printed bool(true) previously, but now prints bool(false). (where foo.html is a file with no errors or warnings)