File php-CVE-2015-6837,6838.patch of Package php5.openSUSE_Leap_42.1_Update
X-Git-Url: http://72.52.91.13:8000/?p=php-src.git;a=blobdiff_plain;f=ext%2Fxsl%2Fxsltprocessor.c;h=d21a8ebcb70c08e8a69f0395b42ee850112e846a;hp=67c90f501f1b9a89d72756537d76e3266ddb8a21;hb=1744be2d17befc69bf00033993f4081852a747d6;hpb=b221df5549533fe04c151cca85be43eb624a643d
Index: ext/xsl/xsltprocessor.c
===================================================================
--- ext/xsl/xsltprocessor.c.orig 2015-09-15 14:35:26.704389342 +0200
+++ ext/xsl/xsltprocessor.c 2015-09-15 14:36:04.238895016 +0200
@@ -219,15 +219,17 @@
}
}
}
-
+
if (error == 1) {
for (i = nargs - 1; i >= 0; i--) {
obj = valuePop(ctxt);
- xmlXPathFreeObject(obj);
+ if (obj) {
+ xmlXPathFreeObject(obj);
+ }
}
return;
}
-
+
fci.param_count = nargs - 1;
if (fci.param_count > 0) {
fci.params = safe_emalloc(fci.param_count, sizeof(zval**), 0);
@@ -297,14 +299,16 @@
xmlXPathFreeObject(obj);
fci.params[i] = &args[i];
}
-
+
fci.size = sizeof(fci);
fci.function_table = EG(function_table);
-
+
obj = valuePop(ctxt);
- if (obj->stringval == NULL) {
- php_error_docref(NULL TSRMLS_CC, E_WARNING, "Handler name must be a string");
- xmlXPathFreeObject(obj);
+ if (obj == NULL || obj->stringval == NULL) {
+ if (obj) {
+ php_error_docref(NULL TSRMLS_CC, E_WARNING, "Handler name must be a string");
+ xmlXPathFreeObject(obj);
+ }
valuePush(ctxt, xmlXPathNewString(""));
if (fci.param_count > 0) {
for (i = 0; i < nargs - 1; i++) {