← 返回首页
ext/dom: Use-after-free with namespace nodes from XSLTProcessor::regi… by devnexen · Pull Request #22623 · php/php-src · GitHub
Skip to content

Navigation Menu

Toggle navigation
Sign in
Appearance settings
Search or jump to...

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Include my email address so I can be contacted

Saved searches

Use saved searches to filter your results more quickly

Appearance settings
Resetting focus

ext/dom: Use-after-free with namespace nodes from XSLTProcessor::regi…#22623

Open
devnexen wants to merge 1 commit into
php:masterfrom
devnexen:gh22621
Open

ext/dom: Use-after-free with namespace nodes from XSLTProcessor::regi…#22623
devnexen wants to merge 1 commit into
php:masterfrom
devnexen:gh22621

Conversation

devnexen commented Jul 6, 2026

Copy link
Copy Markdown
Member

…sterPHPFunctions().

Fix #22621

Namespace parents from an external document() were wrapped directly instead of through the proxy factory, so they skipped the copy that keeps non-main-document nodes alive. A DOMNameSpaceNode retained by userland then dangled once xsltFreeTransformContext() freed the external document. Route the namespace parent through the proxy factory too.

…sterPHPFunctions(). Fix php#22621 Namespace parents from an external document() were wrapped directly instead of through the proxy factory, so they skipped the copy that keeps non-main-document nodes alive. A DOMNameSpaceNode retained by userland then dangled once xsltFreeTransformContext() freed the external document. Route the namespace parent through the proxy factory too.
devnexen marked this pull request as ready for review July 7, 2026 12:16
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

UAF via XSLTProcessor::registerPHPFunctions()

1 participant

Footer

© 2026 GitHub, Inc.