diff --git a/NEWS b/NEWS index 1bba6a7b6c22..a75d304276f3 100644 --- a/NEWS +++ b/NEWS @@ -9,6 +9,15 @@ PHP NEWS class constants via OBJ->prop = $val). (Khaled Alam) . Reverted GH-22833, which attempted to fix bug GH-18985. (ilutov) +- Curl: + . Set content length using CURLOPT_POSTFIELDSIZE_LARGE instead of + CURLOPT_POSTFIELDSIZE. This makes it possible to post strings larger than + 2GB on some platforms, e.g. Windows. (Sjoerd Langkemper) + +- DOM: + . Fixed bug GH-22624 (use-after-free via DOMNameSpaceNode after + DOMDocument::xinclude()). (David Carlier) + - PDO_PGSQL: . Fixed several lazy fetch (PDO::ATTR_PREFETCH => 0) defects: an infinite loop when cleaning up a fetch left in a COPY, a use-after-free when a diff --git a/ext/curl/interface.c b/ext/curl/interface.c index e198b0bb7d77..db3dd01b5505 100644 --- a/ext/curl/interface.c +++ b/ext/curl/interface.c @@ -2178,7 +2178,7 @@ static zend_result _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue /* no need to build the mime structure for empty hashtables; also works around https://github.com/curl/curl/issues/6455 */ curl_easy_setopt(ch->cp, CURLOPT_POSTFIELDS, ""); - error = curl_easy_setopt(ch->cp, CURLOPT_POSTFIELDSIZE, 0L); + error = curl_easy_setopt(ch->cp, CURLOPT_POSTFIELDSIZE_LARGE, (curl_off_t) 0); } else { return build_mime_structure_from_hash(ch, zvalue); } @@ -2186,7 +2186,7 @@ static zend_result _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue zend_string *tmp_str; zend_string *str = zval_get_tmp_string(zvalue, &tmp_str); /* with curl 7.17.0 and later, we can use COPYPOSTFIELDS, but we have to provide size before */ - error = curl_easy_setopt(ch->cp, CURLOPT_POSTFIELDSIZE, ZSTR_LEN(str)); + error = curl_easy_setopt(ch->cp, CURLOPT_POSTFIELDSIZE_LARGE, (curl_off_t) ZSTR_LEN(str)); error = curl_easy_setopt(ch->cp, CURLOPT_COPYPOSTFIELDS, ZSTR_VAL(str)); zend_tmp_string_release(tmp_str); } diff --git a/ext/curl/tests/curl_post_large_string.phpt b/ext/curl/tests/curl_post_large_string.phpt new file mode 100644 index 000000000000..b6bc67825428 --- /dev/null +++ b/ext/curl/tests/curl_post_large_string.phpt @@ -0,0 +1,30 @@ +--TEST-- +CURL post data larger than 2GB (to test CURLOPT_POSTFIELDSIZE_LARGE) +--INI-- +memory_limit=3G +--SKIPIF-- + +--EXTENSIONS-- +curl +--FILE-- + true, + CURLOPT_POST => true, + CURLOPT_POSTFIELDS => $data, +]); + +$response = curl_exec($ch); +var_dump($response); + +?> +--EXPECT-- +string(28) "Content-length: =2147483748=" diff --git a/ext/dom/node.c b/ext/dom/node.c index cc063df66960..362000792f1a 100644 --- a/ext/dom/node.c +++ b/ext/dom/node.c @@ -245,11 +245,21 @@ zend_result dom_node_node_type_read(dom_object *obj, zval *retval) /* }}} */ +static xmlNodePtr dom_node_get_parent(dom_object *obj, xmlNodePtr nodep) +{ + if (nodep->type == XML_NAMESPACE_DECL) { + dom_object_namespace_node *ns = php_dom_namespace_node_obj_from_obj(&obj->std); + return ns->parent_intern ? dom_object_get_node(ns->parent_intern) : NULL; + } + return nodep->parent; +} + + static zend_result dom_node_parent_get(dom_object *obj, zval *retval, bool only_element) { DOM_PROP_NODE(xmlNodePtr, nodep, obj); - xmlNodePtr nodeparent = nodep->parent; + xmlNodePtr nodeparent = dom_node_get_parent(obj, nodep); if (!nodeparent || (only_element && nodeparent->type != XML_ELEMENT_NODE)) { ZVAL_NULL(retval); return SUCCESS; @@ -457,7 +467,12 @@ URL: https://dom.spec.whatwg.org/#dom-node-isconnected zend_result dom_node_is_connected_read(dom_object *obj, zval *retval) { DOM_PROP_NODE(xmlNodePtr, nodep, obj); - ZVAL_BOOL(retval, php_dom_is_node_connected(nodep)); + if (nodep->type == XML_NAMESPACE_DECL) { + xmlNodePtr parent = dom_node_get_parent(obj, nodep); + ZVAL_BOOL(retval, parent && php_dom_is_node_connected(parent)); + } else { + ZVAL_BOOL(retval, php_dom_is_node_connected(nodep)); + } return SUCCESS; } /* }}} */ diff --git a/ext/dom/tests/gh22624.phpt b/ext/dom/tests/gh22624.phpt new file mode 100644 index 000000000000..cab2ada76cfc --- /dev/null +++ b/ext/dom/tests/gh22624.phpt @@ -0,0 +1,41 @@ +--TEST-- +GH-22624 (Use-after-free via DOMNameSpaceNode after DOMDocument::xinclude()) +--CREDITS-- +ExPatch-LLC +--EXTENSIONS-- +dom +--SKIPIF-- + +--FILE-- +'); +$href = 'file:///' . ltrim(str_replace('\\', '/', $included), '/'); + +$doc = new DOMDocument(); +$doc->loadXML(' + + +'); + +$xpath = new DOMXPath($doc); +$xpath->registerNamespace('xi', 'http://www.w3.org/2001/XInclude'); +$xi = $xpath->query('//xi:include')->item(0); +$ns = $xpath->query('namespace::local', $xi)->item(0); // DOMNameSpaceNode + +$doc->xinclude(); // frees the xi:include element + +var_dump($ns->parentNode); +var_dump($ns->parentElement); +var_dump($ns->isConnected); +?> +--CLEAN-- + +--EXPECT-- +NULL +NULL +bool(false) diff --git a/ext/zip/php_zip.c b/ext/zip/php_zip.c index 7488be7828e8..f7a294425e6d 100644 --- a/ext/zip/php_zip.c +++ b/ext/zip/php_zip.c @@ -3319,9 +3319,9 @@ static PHP_MINFO_FUNCTION(zip) php_info_print_table_row(2, "AES-128 encryption", zip_encryption_method_supported(ZIP_EM_AES_128, 1) ? "Yes" : "No"); php_info_print_table_row(2, "AES-192 encryption", - zip_encryption_method_supported(ZIP_EM_AES_128, 1) ? "Yes" : "No"); + zip_encryption_method_supported(ZIP_EM_AES_192, 1) ? "Yes" : "No"); php_info_print_table_row(2, "AES-256 encryption", - zip_encryption_method_supported(ZIP_EM_AES_128, 1) ? "Yes" : "No"); + zip_encryption_method_supported(ZIP_EM_AES_256, 1) ? "Yes" : "No"); #endif php_info_print_table_end();