[Pkg-php-commits] [php/debian-sid] Cherry pick fix for crash with entitity declaration in simplexml.c

[Ondřej Surý]

---
 ...ash-with-entity-declarations-in-simplexml.patch |   41 ++++++++++++++++++++
 debian/patches/series                              |    1 +
 2 files changed, 42 insertions(+), 0 deletions(-)
 create mode 100644 debian/patches/fix-crash-with-entity-declarations-in-simplexml.patch

diff --git a/debian/patches/fix-crash-with-entity-declarations-in-simplexml.patch b/debian/patches/fix-crash-with-entity-declarations-in-simplexml.patch
new file mode 100644
index 0000000..c6cb42c
--- /dev/null
+++ b/debian/patches/fix-crash-with-entity-declarations-in-simplexml.patch
@@ -0,0 +1,41 @@
+--- a/ext/simplexml/simplexml.c
++++ b/ext/simplexml/simplexml.c
+@@ -1099,22 +1099,24 @@ static HashTable * sxe_get_prop_hash(zva
+ 		if (sxe->iter.type == SXE_ITER_ELEMENT) {
+ 			node = php_sxe_get_first_node(sxe, node TSRMLS_CC);
+ 		}
+-		attr = node ? (xmlAttrPtr)node->properties : NULL;
+-		zattr = NULL;
+-		test = sxe->iter.name && sxe->iter.type == SXE_ITER_ATTRLIST;
+-		while (attr) {
+-			if ((!test || !xmlStrcmp(attr->name, sxe->iter.name)) && match_ns(sxe, (xmlNodePtr)attr, sxe->iter.nsprefix, sxe->iter.isprefix)) {
+-				MAKE_STD_ZVAL(value);
+-				ZVAL_STRING(value, sxe_xmlNodeListGetString((xmlDocPtr) sxe->document->ptr, attr->children, 1), 0);
+-				namelen = xmlStrlen(attr->name) + 1;
+-				if (!zattr) {
+-					MAKE_STD_ZVAL(zattr);
+-					array_init(zattr);
+-					sxe_properties_add(rv, "@attributes", sizeof("@attributes"), zattr TSRMLS_CC);
++		if (node->tpye != XML_ENTITY_DECL) {
++			attr = node ? (xmlAttrPtr)node->properties : NULL;
++			zattr = NULL;
++			test = sxe->iter.name && sxe->iter.type == SXE_ITER_ATTRLIST;
++			while (attr) {
++				if ((!test || !xmlStrcmp(attr->name, sxe->iter.name)) && match_ns(sxe, (xmlNodePtr)attr, sxe->iter.nsprefix, sxe->iter.isprefix)) {
++					MAKE_STD_ZVAL(value);
++					ZVAL_STRING(value, sxe_xmlNodeListGetString((xmlDocPtr) sxe->document->ptr, attr->children, 1), 0);
++					namelen = xmlStrlen(attr->name) + 1;
++					if (!zattr) {
++						MAKE_STD_ZVAL(zattr);
++						array_init(zattr);
++						sxe_properties_add(rv, "@attributes", sizeof("@attributes"), zattr TSRMLS_CC);
++					}
++					add_assoc_zval_ex(zattr, (char*)attr->name, namelen, value);
+ 				}
+-				add_assoc_zval_ex(zattr, (char*)attr->name, namelen, value);
++				attr = attr->next;
+ 			}
+-			attr = attr->next;
+ 		}
+ 	}
+ 
diff --git a/debian/patches/series b/debian/patches/series
index 3778317..50f19b4 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -78,3 +78,4 @@ CVE-2010-4150.patch
 fix-infinite-loop-with-x87-cpu.patch
 do-not-overwrite-GLOBALS-and-this.patch
 fix-crash-if-aa-steps-are-invalid.patch
+fix-crash-with-entity-declarations-in-simplexml.patch
-- 
1.7.1