archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix GH-14698: segfault on dom node after dereference.

Browse source 
close GH-14701
This commit is contained in:
David Carlier 2024-06-28 13:09:52 +01:00
parent 03dab7ec3d
commit 532a2604c2
No known key found for this signature in database
GPG key ID: CEF290BB40D2086B
3 changed files with 30 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

10
ext/libxml/libxml.c
View file

@ -329,9 +329,13 @@ PHP_LIBXML_API void php_libxml_node_free_list(xmlNodePtr node)
/* This ensures that namespace references in this subtree are defined within this subtree,
* otherwise a use-after-free would be possible when the original namespace holder gets freed. */
php_libxml_node_ptr *ptr = curnode->_private;
php_libxml_node_object *obj = ptr->_private;
if (!obj->document || obj->document->class_type < PHP_LIBXML_CLASS_MODERN) {
xmlReconciliateNs(curnode->doc, curnode);
/* Checking in case it runs out of reference */
if (ptr->_private) {
php_libxml_node_object *obj = ptr->_private;
if (!obj->document || obj->document->class_type < PHP_LIBXML_CLASS_MODERN) {
xmlReconciliateNs(curnode->doc, curnode);
}
}
}
/* Skip freeing */