Bug #66783 [Ver->Csd]: Double free or corruption if appending DOMDocument to element

Edit report at https://bugs.php.net/bug.php?id=66783&edit=1 ID: 66783 Updated by: cmb@php.net Reported by: mfonda@php.net Summary: Double free or corruption if appending DOMDocument to element -Status: Verified +Status: Closed Type: Bug Package: DOM XML related Operating System: Linux PHP Version: Irrelevant Assigned To: cmb Block user comment: N Private report: N New Comment: Automatic comment on behalf of cmbecker69@gmx.de Revision: http://git.php.net/?p=php-src.git;a=commit;h=a08847ab39bb512d500cf196981a3e8780c83600 Log: Fix #66783: UAF when appending DOMDocument to element Previous Comments: ------------------------------------------------------------------------ [2021-03-12 15:14:05] cmb@php.net Related To: Bug #66551 ------------------------------------------------------------------------ [2021-03-12 14:53:20] cmb@php.net The following pull request has been associated: Patch Name: Fix #66783: UAF when appending DOMDocument to element On GitHub: https://github.com/php/php-src/pull/6765 Patch: https://github.com/php/php-src/pull/6765.patch ------------------------------------------------------------------------ [2021-03-12 14:51:38] cmb@php.net This use-after-free can easily be prevented, by following the DOM standard, and not allowing that insertion in the first place. ------------------------------------------------------------------------ [2015-07-10 16:10:54] cmb@php.net Related to bug #66551. ------------------------------------------------------------------------ [2014-02-27 17:10:39] krakjoe@php.net https://bugs.php.net/bug.php?id=61797 It's because of that ... if anyone has input, I'm happy to patch it ... ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=66783 -- Edit this bug report at https://bugs.php.net/bug.php?id=66783&edit=1