Fix #71592: External entity processing never fails #3596
Conversation
If the callback set via `xml_set_external_entity_ref_handler()` returns a falsy value, parsing is supposed to stop and the error number set to `XML_ERROR_EXTERNAL_ENTITY_HANDLING`. This is already correctly done by the libexpat binding, but the libxml2 binding ignores the return value. We fix this by calling `xmlStopParser()` which is available as of libxml 2.1.0[1] (PHP-7.1 requires at least libxml 2.6.11 anyway), and setting the desired `errNo` ourselves. [1] <http://xmlsoft.org/news.html>
|
Almost any ext/xml nowadays likely runs on libxml2, and it's not unlikely that a lot of |
|
Comment on behalf of petk at php.net: Labelling |
|
Is any of the XML maintainers still around to review this PR? While this PR is primarily intended to fix a bug in ext/xml, it might also affect other extensions which use the expat compatibility layer (e.g. ext/wddx and ext/xmlrpc). |
|
Unless there are objections, I'm going to merge this on the next weekend. |
|
Comment on behalf of cmb at php.net: Applied as 829b0df. |
|
Documented via http://svn.php.net/viewvc?view=revision&revision=345905. |
Cf. <php/php-src#3596>. git-svn-id: https://svn.php.net/repository/phpdoc/en/trunk@345905 c90b9560-bf6c-de11-be94-00142212c4b1
Cf. <php/php-src#3596>. git-svn-id: http://svn.php.net/repository/phpdoc/en@345905 c90b9560-bf6c-de11-be94-00142212c4b1
Cf. <php/php-src#3596>. git-svn-id: https://svn.php.net/repository/phpdoc/en/trunk@345905 c90b9560-bf6c-de11-be94-00142212c4b1
Cf. <php/php-src#3596>. git-svn-id: https://svn.php.net/repository/phpdoc/en/trunk@345905 c90b9560-bf6c-de11-be94-00142212c4b1
If the callback set via
xml_set_external_entity_ref_handler()returnsa falsy value, parsing is supposed to stop and the error number set to
XML_ERROR_EXTERNAL_ENTITY_HANDLING. This is already correctly doneby the libexpat binding, but the libxml2 binding ignores the return
value. We fix this by calling
xmlStopParser()which is available asof libxml 2.1.0[1] (PHP-7.1 requires at least libxml 2.6.11 anyway),
and setting the desired
errNoourselves.[1] http://xmlsoft.org/news.html