Fix null pointer dereferences in case of allocation failure

Closes GH-12506.
php · Oct 24, 2023 · 900f0ca · 900f0ca
1 parent aa45df4
commit 900f0ca
Show file tree

Hide file tree

Showing 4 changed files with 16 additions and 0 deletions.
diff --git a/NEWS b/NEWS
@@ -8,6 +8,7 @@ PHP                                                                        NEWS
 
 - DOM:
   . Fix registerNodeClass with abstract class crashing. (nielsdos)
+  . Add missing NULL pointer error check. (icy17)
 
 - Fiber:
   . Fixed bug GH-11121 (ReflectionFiber segfault). (danog, trowski, bwoebi)
@@ -39,6 +40,12 @@ PHP                                                                        NEWS
   . Fixed bug #75708 (getimagesize with "&$imageinfo" fails on StreamWrappers).
     (Jakub Zelenka)
 
+- XMLReader:
+  . Add missing NULL pointer error check. (icy17)
+
+- XMLWriter:
+  . Add missing NULL pointer error check. (icy17)
+
 - XSL:
   . Add missing module dependency. (nielsdos)
 

diff --git a/ext/dom/document.c b/ext/dom/document.c
@@ -1148,6 +1148,9 @@ char *_dom_get_valid_file_path(char *source, char *resolved_path, int resolved_p
 	int isFileUri = 0;
 
 	uri = xmlCreateURI();
+	if (uri == NULL) {
+		return NULL;
+	}
 	escsource = xmlURIEscapeStr((xmlChar *) source, (xmlChar *) ":");
 	xmlParseURIReference(uri, (char *) escsource);
 	xmlFree(escsource);

diff --git a/ext/xmlreader/php_xmlreader.c b/ext/xmlreader/php_xmlreader.c
@@ -211,6 +211,9 @@ char *_xmlreader_get_valid_file_path(char *source, char *resolved_path, int reso
 	int isFileUri = 0;
 
 	uri = xmlCreateURI();
+	if (uri == NULL) {
+		return NULL;
+	}
 	escsource = xmlURIEscapeStr((xmlChar *)source, (xmlChar *)":");
 	xmlParseURIReference(uri, (const char *)escsource);
 	xmlFree(escsource);

diff --git a/ext/xmlwriter/php_xmlwriter.c b/ext/xmlwriter/php_xmlwriter.c
@@ -110,6 +110,9 @@ static char *_xmlwriter_get_valid_file_path(char *source, char *resolved_path, i
 	int isFileUri = 0;
 
 	uri = xmlCreateURI();
+	if (uri == NULL) {
+		return NULL;
+	}
 	escsource = xmlURIEscapeStr((xmlChar *)source, (xmlChar *) ":");
 	xmlParseURIReference(uri, (char *)escsource);
 	xmlFree(escsource);