archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 13:38:49 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix unlikely memory leak in case of namespace removal with extremely deep trees

Browse source
This commit is contained in:
Niels Dossche 2024-02-05 22:48:00 +01:00
parent b710f6f77f
commit ab508c98b3
2 changed files with 8 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
NEWS
View file

@ -5,6 +5,10 @@ PHP NEWS
- Curl: - Curl:
. Fix failing tests due to string changes in libcurl 8.6.0. (Ayesh) . Fix failing tests due to string changes in libcurl 8.6.0. (Ayesh)
- DOM:
. Fix unlikely memory leak in case of namespace removal with extremely deep
trees. (nielsdos)
- FPM: - FPM:
. Fixed bug #75712 (getenv in php-fpm should not read $_ENV, $_SERVER). . Fixed bug #75712 (getenv in php-fpm should not read $_ENV, $_SERVER).
(Jakub Zelenka) (Jakub Zelenka)
@ -15,6 +19,8 @@ PHP NEWS
. Fixed array key as hash to string (case insensitive) comparison typo . Fixed array key as hash to string (case insensitive) comparison typo
for the second operand buffer size (albeit unused for now). (A. Slepykh) for the second operand buffer size (albeit unused for now). (A. Slepykh)
5 Feb 2024, PHP 8.3.3
- Core: - Core:
. Fixed timer leak in zend-max-execution-timers builds. (withinboredom) . Fixed timer leak in zend-max-execution-timers builds. (withinboredom)
. Fixed bug GH-12349 (linking failure on ARM with mold). (Jan Palus) . Fixed bug GH-12349 (linking failure on ARM with mold). (Jan Palus)

3
ext/dom/element.c
View file

@ -461,7 +461,7 @@ static void dom_deep_ns_redef(xmlNodePtr node, xmlNsPtr ns_to_redefine)
if (worklist_size == worklist_capacity) { if (worklist_size == worklist_capacity) {
if (UNEXPECTED(worklist_capacity >= SIZE_MAX / 3 * 2 / sizeof(dom_deep_ns_redef_item))) { if (UNEXPECTED(worklist_capacity >= SIZE_MAX / 3 * 2 / sizeof(dom_deep_ns_redef_item))) {
/* Shouldn't be possible to hit, but checked for safety anyway */ /* Shouldn't be possible to hit, but checked for safety anyway */
return; goto out;
} }
worklist_capacity = worklist_capacity * 3 / 2; worklist_capacity = worklist_capacity * 3 / 2;
worklist = erealloc(worklist, sizeof(dom_deep_ns_redef_item) * worklist_capacity); worklist = erealloc(worklist, sizeof(dom_deep_ns_redef_item) * worklist_capacity);
@ -472,6 +472,7 @@ static void dom_deep_ns_redef(xmlNodePtr node, xmlNsPtr ns_to_redefine)
} }
} }
out:
efree(worklist); efree(worklist);
} }