https://bugzilla.wikimedia.org/show_bug.cgi?id=65081

            Bug ID: 65081
           Summary: Scribunto gives half bytes to preprocessor which gives
                    a fatal
           Product: MediaWiki extensions
           Version: REL1_23 branch
          Hardware: All
                OS: All
            Status: NEW
          Severity: normal
          Priority: Unprioritized
         Component: Scribunto
          Assignee: [email protected]
          Reporter: [email protected]
                CC: [email protected], [email protected],
                    [email protected]
       Web browser: ---
   Mobile Platform: ---

User PerfektesChaos from dewiki has wrote a example lua module, which produces
a fatal in the php preprocessor.

The module is:

-- Cause a server crash.
-- includes/parser/Preprocessor_DOM.php line 1692:
--         "Call to a member function item() on a non-object"
-- Crashes any 1.24wmf1 wiki, not only beta.wmflabs.org

local p = { }

function p.f( frame )
    local story = "รถ"                  -- non-ASCII char
    local sub   = story:sub( 1, 1 )    -- ASCII substring at half of UTF-8
                                       -- should have been mw.ustring.sub()
    return frame:callParserFunction( "#tag:nowiki", { sub } )
end -- p.f

return p


The error is:
includes/parser/Preprocessor_DOM.php line 1692: "Call to a member function
item() on a non-object"

I have run it with warnings on on my dev machine and the output is:
Warning: DOMDocument::loadXML() [domdocument.loadxml]: Input is not proper
UTF-8, indicate encoding ! Bytes: 0xC3 0x3C 0x2F 0x76 in Entity, line: 1 in
\includes\parser\Preprocessor_DOM.php on line 85

Notice: Trying to get property of non-object in
\includes\parser\Preprocessor_DOM.php on line 88

Fatal error: Call to a member function item() on a non-object in
\includes\parser\Preprocessor_DOM.php on line 1692


See http://de.wikipedia.beta.wmflabs.org/wiki/MakeTheServerCrash for more
information and a link to the example page.

Looks like the half byte is mangeled into the builded xml in the preprocessor
and than it gives a invalid xml.

-- 
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
_______________________________________________
Wikibugs-l mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/wikibugs-l

Reply via email to