Fix #73533: Invalid memory access in php_libxml_xmlCheckUTF8

cmb69 · cmb69 · commit 498eb8e0529f · 2021-03-24T11:50:50.000+01:00
A string passed to `php_libxml_xmlCheckUTF8()` may be longer than 1<<31-1 bytes, so we're better using a `size_t`. Closes phpGH-6802.
diff --git a/NEWS b/NEWS
@@ -9,6 +9,9 @@ PHP                                                                        NEWS
   . Fixed bug #80024 (Duplication of info about inherited socket after pool
     removing). (Jakub Zelenka)
 
+- LibXML:
+  . Fixed bug #73533 (Invalid memory access in php_libxml_xmlCheckUTF8). (cmb)
+
 - PDO_ODBC:
   . Fixed bug #80783 (PDO ODBC truncates BLOB records at every 256th byte).
     (cmb)
diff --git a/ext/libxml/libxml.c b/ext/libxml/libxml.c
@@ -1182,7 +1182,7 @@ static PHP_FUNCTION(libxml_set_external_entity_loader)
 /* {{{ Common functions shared by extensions */
 int php_libxml_xmlCheckUTF8(const unsigned char *s)
 {
-	int i;
+	size_t i;
 	unsigned char c;
 
 	for (i = 0; (c = s[i++]);) {

Original file line number	Diff line number	Diff line change
`@@ -1182,7 +1182,7 @@ static PHP_FUNCTION(libxml_set_external_entity_loader)`
`1182`	`1182`	`/* {{{ Common functions shared by extensions */`
`1183`	`1183`	`int php_libxml_xmlCheckUTF8(const unsigned char *s)`
`1184`	`1184`	`{`
`1185`		`- int i;`
	`1185`	`+ size_t i;`
`1186`	`1186`	`unsigned char c;`
`1187`	`1187`
`1188`	`1188`	`for (i = 0; (c = s[i++]);) {`