Bug #80927 [NEW]: Removing documentElement after creating attribute node: possible use-after-free
From: jking at jkingweb dot ca
Operating system: any
PHP version: 8.0.3
Package: DOM XML related
Bug Type: Bug
Bug description:Removing documentElement after creating attribute node: possible use-after-free
Description:
------------
See test script. While it is somewhat contrived, it is a situation I ran
into setting up unit tests.
When removing the document element out from under an attribute node, the
namespaceURI and prefix properties of the DOMAttr will contain garbage
bytes instead of the specified values. As the prefix property is
writeable it may be possible to corrupt memory this way, though I have
not confirmed this.
Test script:
---------------
$d = new \DOMDocument();
$d->appendChild($d->createElement("html"));
$a = $d->createAttributeNS("fake_ns", "test:test");
$d->removeChild($d->documentElement);
echo $a->namespaceURI;
echo $a->prefix;
Expected result:
----------------
Obviously I would expect the namespaceURI and prefix properties not to
be corrupted. Given the apparent underlying limitations of libxml I
might expect an exception to be thrown when trying to remove the
document element.
--
Edit bug report at https://bugs.php.net/bug.php?id=80927&edit=1
--
Fix committed: https://bugs.php.net/fix.php?id=80927&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=80927&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=80927&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=80927&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=80927&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=80927&r=support
Expected behavior: https://bugs.php.net/fix.php?id=80927&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=80927&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=80927&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=80927&r=globals
PHP version support discontinued: https://bugs.php.net/fix.php?id=80927&r=phptooold
Daylight Savings: https://bugs.php.net/fix.php?id=80927&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=80927&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=80927&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=80927&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=80927&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=80927&r=mysqlcfg
Thread (5 messages)
- jking at jkingweb dot ca