Commit f576b81

committed

Merge branch 'PHP-8.4'

* PHP-8.4: Fix GH-16906: Reloading document can cause UAF in iterator

2 parents cd977ae + 52c7c74 commit f576b81Copy full SHA for f576b81

File tree

+24

-0

lines changed

+24

-0

lines changed

Lines changed: 6 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -1465,6 +1465,10 @@ void dom_namednode_iter(dom_object basenode, int ntype, dom_object intern, xml`
`1465`	`1465`	`mapptr->baseobj = basenode;`
`1466`	`1466`	`mapptr->nodetype = ntype;`
`1467`	`1467`	`mapptr->ht = ht;`
	`1468`	`+ if (EXPECTED(doc != NULL)) {`
	`1469`	`+ mapptr->dict = doc->dict;`
	`1470`	`+ xmlDictReference(doc->dict);`
	`1471`	`+ }`
`1468`	`1472`
`1469`	`1473`	`const xmlChar* tmp;`
`1470`	`1474`
`@@ -1578,6 +1582,7 @@ void dom_nnodemap_objects_free_storage(zend_object object) / {{{ */`
`1578`	`1582`	`if (!Z_ISUNDEF(objmap->baseobj_zv)) {`
`1579`	`1583`	`zval_ptr_dtor(&objmap->baseobj_zv);`
`1580`	`1584`	`}`
	`1585`	`+ xmlDictFree(objmap->dict);`
`1581`	`1586`	`efree(objmap);`
`1582`	`1587`	`intern->ptr = NULL;`
`1583`	`1588`	`}`
`@@ -1609,6 +1614,7 @@ zend_object dom_nnodemap_objects_new(zend_class_entry class_type)`
`1609`	`1614`	`objmap->cached_length = -1;`
`1610`	`1615`	`objmap->cached_obj = NULL;`
`1611`	`1616`	`objmap->cached_obj_index = 0;`
	`1617`	`+ objmap->dict = NULL;`
`1612`	`1618`
`1613`	`1619`	`return &intern->std;`
`1614`	`1620`	`}`

Lines changed: 1 addition & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -88,6 +88,7 @@ typedef struct dom_nnodemap_object {`
`88`	`88`	`php_libxml_cache_tag cache_tag;`
`89`	`89`	`dom_object *cached_obj;`
`90`	`90`	`zend_long cached_obj_index;`
	`91`	`+ xmlDictPtr dict;`
`91`	`92`	`bool free_local : 1;`
`92`	`93`	`bool free_ns : 1;`
`93`	`94`	`} dom_nnodemap_object;`

Lines changed: 17 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,17 @@`
	`1`	`+--TEST--`
	`2`	`+GH-16906 (Reloading document can cause UAF in iterator)`
	`3`	`+--EXTENSIONS--`
	`4`	`+dom`
	`5`	`+--FILE--`
	`6`	`+<?php`
	`7`	`+$doc = new DOMDocument;`
	`8`	`+$doc->loadXML('<?xml version="1.0"?><span><strong id="1"/><strong id="2"/></span>');`
	`9`	`+$list = $doc->getElementsByTagName('strong');`
	`10`	`+$doc->load(__DIR__."/book.xml");`
	`11`	`+var_dump($list);`
	`12`	`+?>`
	`13`	`+--EXPECT--`
	`14`	`+object(DOMNodeList)#2 (1) {`
	`15`	`+ ["length"]=>`
	`16`	`+ int(0)`
	`17`	`+}`

Comments

(0)