Skip to content

ext/dom: Fix Dom\DtdNamedNodeMap index overflow in dimension access#22630

Open
LamentXU123 wants to merge 2 commits into
php:masterfrom
LamentXU123:fix-dom-overflow
Open

ext/dom: Fix Dom\DtdNamedNodeMap index overflow in dimension access#22630
LamentXU123 wants to merge 2 commits into
php:masterfrom
LamentXU123:fix-dom-overflow

Conversation

@LamentXU123

Copy link
Copy Markdown
Member

Dom\DtdNamedNodeMap dimension access could overflow the index when reading DTD entities or notations.

<?php
$doc = Dom\XMLDocument::createFromString("<!DOCTYPE root [<!ENTITY e 'x'>]><root/>");

var_dump($doc->doctype->entities[4294967296]?->nodeName);
string(1) "e"

}
}

dump_access(fn() => $doc->doctype->entities[$overflow]);

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: let s test the negative values too

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants