[php-src] PHP-8.6: Merge branch 'PHP-8.4' into PHP-8.5

Author: David Carlier (devnexen) Date: 2026-10-23T16:56:29+01:00 Commit: https://github.com/php/php-src/commit/56e3429f253b24822c9f9e534239e42dab62e46a Raw diff: https://github.com/php/php-src/commit/56e3429f253b24822c9f9e534239e42dab62e46a.diff Merge branch 'PHP-8.4' into PHP-8.5 * PHP-8.4: Fix GH-22554: ext/dom: UAF with XPath callback returning foreign-doc node Changed paths: A ext/dom/tests/gh22554.phpt M ext/dom/xpath.c Diff: diff --git a/ext/dom/tests/gh22554.phpt b/ext/dom/tests/gh22554.phpt new file mode 100644 index 000000000000..c8db1d87390b --- /dev/null +++ b/ext/dom/tests/gh22554.phpt @@ -0,0 +1,38 @@ +--TEST-- +GH-22554 (Use-after-free when an XPath callback returns a node from a document created inside the callback) +--CREDITS-- +waseem-cve +--EXTENSIONS-- +dom +--FILE-- +<?php + +$doc = new DOMDocument; +$doc->loadXML('<root/>'); + +$xp = new DOMXPath($doc); +$xp->registerNamespace('my', 'my.ns'); + +$xp->registerPHPFunctionNS('my.ns', 'include', function () { + $d = new DOMDocument; + $d->loadXML('<r><uaf/></r>'); + + return $d->documentElement; +}); + +$xp->registerPHPFunctionNS('my.ns', 'process', function ($arg) { + echo "process arg: ", get_class($arg[0]), " ", $arg[0]->nodeName, "\n"; + return 'x'; +}); + +$result = $xp->query('my:process(my:include()/uaf)'); +var_dump($result->length); +unset($xp); + +echo "Done\n"; + +?> +--EXPECT-- +process arg: DOMElement uaf +int(0) +Done diff --git a/ext/dom/xpath.c b/ext/dom/xpath.c index f5ed6dc4a656..9199785b8138 100644 --- a/ext/dom/xpath.c +++ b/ext/dom/xpath.c @@ -98,7 +98,8 @@ static void dom_xpath_proxy_factory(xmlNodePtr node, zval *child, dom_object *in ZEND_ASSERT(node->type != XML_NAMESPACE_DECL); - php_dom_create_object(node, child, intern); + dom_xpath_object *xobj = php_xpath_obj_from_obj(&intern->std); + php_dom_create_object(node, child, dom_xpath_intern_for_doc(xobj, node->doc)); } static dom_xpath_object *dom_xpath_ext_fetch_intern(xmlXPathParserContextPtr ctxt)