diff --git a/ext/dom/notation.c b/ext/dom/notation.c index a15fae9ee9d8e..f83b31428e16c 100644 --- a/ext/dom/notation.c +++ b/ext/dom/notation.c @@ -31,8 +31,6 @@ * Since: */ -/* {{{ attribute protos, not implemented yet */ - /* {{{ publicId string readonly=yes URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#ID-54F2B4D0 @@ -73,6 +71,4 @@ zend_result dom_notation_system_id_read(dom_object *obj, zval *retval) /* }}} */ -/* }}} */ - #endif diff --git a/ext/dom/php_dom.c b/ext/dom/php_dom.c index 3619eaef12a5f..a39e5c1656e9e 100644 --- a/ext/dom/php_dom.c +++ b/ext/dom/php_dom.c @@ -714,15 +714,17 @@ static zend_object *dom_object_namespace_node_clone_obj(zend_object *zobject) zend_object *clone = dom_objects_namespace_node_new(intern->dom.std.ce); dom_object_namespace_node *clone_intern = php_dom_namespace_node_obj_from_obj(clone); - xmlNodePtr original_node = dom_object_get_node(&intern->dom); - ZEND_ASSERT(original_node->type == XML_NAMESPACE_DECL); - xmlNodePtr cloned_node = php_dom_create_fake_namespace_decl_node_ptr(original_node->parent, original_node->ns); - if (intern->parent_intern) { clone_intern->parent_intern = intern->parent_intern; GC_ADDREF(&clone_intern->parent_intern->std); } - dom_update_refcount_after_clone(&intern->dom, original_node, &clone_intern->dom, cloned_node); + + xmlNodePtr original_node = dom_object_get_node(&intern->dom); + if (original_node != NULL) { + ZEND_ASSERT(original_node->type == XML_NAMESPACE_DECL); + xmlNodePtr cloned_node = php_dom_create_fake_namespace_decl_node_ptr(original_node->parent, original_node->ns); + dom_update_refcount_after_clone(&intern->dom, original_node, &clone_intern->dom, cloned_node); + } zend_objects_clone_members(clone, &intern->dom.std); return clone; diff --git a/ext/dom/tests/gh20722.phpt b/ext/dom/tests/gh20722.phpt new file mode 100644 index 0000000000000..38d3314618f3e --- /dev/null +++ b/ext/dom/tests/gh20722.phpt @@ -0,0 +1,13 @@ +--TEST-- +GH-20722 (Null pointer dereference in DOM namespace node cloning via clone on malformed objects) +--EXTENSIONS-- +dom +--FILE-- + +--EXPECT-- +Done diff --git a/ext/mysqli/mysqli_api.c b/ext/mysqli/mysqli_api.c index 65c423990bc9d..1bf74dd77eeab 100644 --- a/ext/mysqli/mysqli_api.c +++ b/ext/mysqli/mysqli_api.c @@ -1343,9 +1343,6 @@ PHP_FUNCTION(mysqli_real_query) } /* }}} */ -# define mysql_real_escape_string_quote(mysql, to, from, length, quote) \ - mysql_real_escape_string(mysql, to, from, length) - PHP_FUNCTION(mysqli_real_escape_string) { MY_MYSQL *mysql; zval *mysql_link = NULL; @@ -1359,7 +1356,7 @@ PHP_FUNCTION(mysqli_real_escape_string) { MYSQLI_FETCH_RESOURCE_CONN(mysql, mysql_link, MYSQLI_STATUS_VALID); newstr = zend_string_safe_alloc(2, escapestr_len, 0, 0); - ZSTR_LEN(newstr) = mysql_real_escape_string_quote(mysql->mysql, ZSTR_VAL(newstr), escapestr, escapestr_len, '\''); + ZSTR_LEN(newstr) = mysql_real_escape_string(mysql->mysql, ZSTR_VAL(newstr), escapestr, escapestr_len); newstr = zend_string_truncate(newstr, ZSTR_LEN(newstr), 0); RETURN_NEW_STR(newstr);