Skip to content

Commit 52c7c74

Browse files
committed
Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3: Fix phpGH-16906: Reloading document can cause UAF in iterator
2 parents 9ee6078 + 9d39ff7 commit 52c7c74

File tree

4 files changed

+28
-0
lines changed

4 files changed

+28
-0
lines changed

NEWS

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,10 @@ PHP NEWS
22
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
33
?? ??? ????, PHP 8.4.2
44

5+
- DOM:
6+
. Fixed bug GH-16906 (Reloading document can cause UAF in iterator).
7+
(nielsdos)
8+
59
- Opcache:
610
. Fixed bug GH-16851 (JIT_G(enabled) not set correctly on other threads).
711
(dktapps)

ext/dom/php_dom.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1469,6 +1469,10 @@ void dom_namednode_iter(dom_object *basenode, int ntype, dom_object *intern, xml
14691469
mapptr->baseobj = basenode;
14701470
mapptr->nodetype = ntype;
14711471
mapptr->ht = ht;
1472+
if (EXPECTED(doc != NULL)) {
1473+
mapptr->dict = doc->dict;
1474+
xmlDictReference(doc->dict);
1475+
}
14721476

14731477
const xmlChar* tmp;
14741478

@@ -1582,6 +1586,7 @@ void dom_nnodemap_objects_free_storage(zend_object *object) /* {{{ */
15821586
if (!Z_ISUNDEF(objmap->baseobj_zv)) {
15831587
zval_ptr_dtor(&objmap->baseobj_zv);
15841588
}
1589+
xmlDictFree(objmap->dict);
15851590
efree(objmap);
15861591
intern->ptr = NULL;
15871592
}
@@ -1613,6 +1618,7 @@ zend_object *dom_nnodemap_objects_new(zend_class_entry *class_type)
16131618
objmap->cached_length = -1;
16141619
objmap->cached_obj = NULL;
16151620
objmap->cached_obj_index = 0;
1621+
objmap->dict = NULL;
16161622

16171623
return &intern->std;
16181624
}

ext/dom/php_dom.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,7 @@ typedef struct dom_nnodemap_object {
8888
php_libxml_cache_tag cache_tag;
8989
dom_object *cached_obj;
9090
zend_long cached_obj_index;
91+
xmlDictPtr dict;
9192
bool free_local : 1;
9293
bool free_ns : 1;
9394
} dom_nnodemap_object;

ext/dom/tests/gh16906.phpt

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
--TEST--
2+
GH-16906 (Reloading document can cause UAF in iterator)
3+
--EXTENSIONS--
4+
dom
5+
--FILE--
6+
<?php
7+
$doc = new DOMDocument;
8+
$doc->loadXML('<?xml version="1.0"?><span><strong id="1"/><strong id="2"/></span>');
9+
$list = $doc->getElementsByTagName('strong');
10+
$doc->load(__DIR__."/book.xml");
11+
var_dump($list);
12+
?>
13+
--EXPECT--
14+
object(DOMNodeList)#2 (1) {
15+
["length"]=>
16+
int(0)
17+
}

0 commit comments

Comments
 (0)