mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-30 21:35:36 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.4'

Browse Source 
* PHP-8.4:
  Fix GH-16906: Reloading document can cause UAF in iterator
This commit is contained in:
Niels Dossche 2024-11-24 18:20:29 +01:00
commit f576b81340
No known key found for this signature in database
GPG Key ID: B8A8AD166DF0E2E5
3 changed files with 24 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
ext/dom/php_dom.c
View File

@ -1465,6 +1465,10 @@ void dom_namednode_iter(dom_object *basenode, int ntype, dom_object *intern, xml
mapptr->baseobj = basenode;
mapptr->nodetype = ntype;
mapptr->ht = ht;
if (EXPECTED(doc != NULL)) {
mapptr->dict = doc->dict;
xmlDictReference(doc->dict);
}
const xmlChar* tmp;
@ -1578,6 +1582,7 @@ void dom_nnodemap_objects_free_storage(zend_object *object) /* {{{ */
if (!Z_ISUNDEF(objmap->baseobj_zv)) {
zval_ptr_dtor(&objmap->baseobj_zv);
}
xmlDictFree(objmap->dict);
efree(objmap);
intern->ptr = NULL;
}
@ -1609,6 +1614,7 @@ zend_object *dom_nnodemap_objects_new(zend_class_entry *class_type)
objmap->cached_length = -1;
objmap->cached_obj = NULL;
objmap->cached_obj_index = 0;
objmap->dict = NULL;
return &intern->std;
}

1
ext/dom/php_dom.h
View File

@ -88,6 +88,7 @@ typedef struct dom_nnodemap_object {
php_libxml_cache_tag cache_tag;
dom_object *cached_obj;
zend_long cached_obj_index;
xmlDictPtr dict;
bool free_local : 1;
bool free_ns : 1;
} dom_nnodemap_object;

17
ext/dom/tests/gh16906.phpt Normal file
View File

@ -0,0 +1,17 @@
--TEST--
GH-16906 (Reloading document can cause UAF in iterator)
--EXTENSIONS--
dom
--FILE--
<?php
$doc = new DOMDocument;
$doc->loadXML('<?xml version="1.0"?><span><strong id="1"/><strong id="2"/></span>');
$list = $doc->getElementsByTagName('strong');
$doc->load(__DIR__."/book.xml");
var_dump($list);
?>
--EXPECT--
object(DOMNodeList)#2 (1) {
["length"]=>
int(0)
}