archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix #70078: XSL callbacks with nodes as parameter leak memory

Browse source 
The fix for bug #49634 solved a double-free by copying the node with
`xmlDocCopyNodeList()`, but the copied node is later freed by calling
`xmlFreeNode()` instead of `xmlFreeNodeList()`, thus leaking memory.
However, there is no need to treat the node as node list, i.e. to copy
also the node's siblings; just creating a recursive copy of the node
with `xmlDocCopyNode()` is sufficient, while that also avoids the leak.
This commit is contained in:
Christoph M. Becker 2020-01-29 18:23:51 +01:00
parent 494615fcb8
commit 8226e704e4
3 changed files with 55 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
ext/xsl/xsltprocessor.c
View file

@ -274,7 +274,7 @@ static void xsl_ext_function_php(xmlXPathParserContextPtr ctxt, int nargs, int t
node->parent = nsparent;
node->ns = curns;
} else {
node = xmlDocCopyNodeList(domintern->document->ptr, node);
node = xmlDocCopyNode(node, domintern->document->ptr, 1);
}
php_dom_create_object(node, &child, domintern);