components/php/php56/patches/CVE-2015-6837_CVE-2015-6838.patch
author Michael Nestler <Michael.Nestler@Oracle.COM>
Thu, 19 Nov 2015 22:52:15 -0800
changeset 5116 867d838118ad
permissions -rw-r--r--
22244227 problem in UTILITY/PHP 21577672 problem in UTILITY/PHP 22244239 problem in UTILITY/PHP 22244245 problem in UTILITY/PHP 22244247 problem in UTILITY/PHP 22244253 problem in UTILITY/PHP 22244256 problem in UTILITY/PHP 22244261 problem in UTILITY/PHP 22244265 problem in UTILITY/PHP 22244270 problem in UTILITY/PHP 22244277 problem in UTILITY/PHP 22244286 problem in UTILITY/PHP

# Source: upstream
# https://bugs.php.net/bug.php?id=69782
# Official fix: https://github.com/php/php-src/commit/1744be2d17befc69bf00033993f4081852a747d6.patch
# Clean patch: http://pastie.org/private/puvwu1gtr4qkextmrqmkmq
# Patch adapted/regenerated.

--- xsltprocessor.c.orig	2015-09-09 14:59:20.354579467 -0700
+++ php-5.6.8/ext/xsl/xsltprocessor.c	2015-09-09 15:01:03.737672429 -0700
@@ -223,7 +223,10 @@
 	if (error == 1) {
 		for (i = nargs - 1; i >= 0; i--) {
 			obj = valuePop(ctxt);
-			xmlXPathFreeObject(obj);
+
+			if (obj) {
+				xmlXPathFreeObject(obj);
+			}
 		}
 		return;
 	}
@@ -302,9 +305,11 @@
 	fci.function_table = EG(function_table);
 	
 	obj = valuePop(ctxt);
-	if (obj->stringval == NULL) {
-		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Handler name must be a string");
-		xmlXPathFreeObject(obj);
+	if (obj == NULL || obj->stringval == NULL) {
+		if (obj && obj->stringval == NULL) {
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Handler name must be a string");
+			xmlXPathFreeObject(obj);
+		}
 		valuePush(ctxt, xmlXPathNewString(""));
 		if (fci.param_count > 0) {
 			for (i = 0; i < nargs - 1; i++) {