[php-src] PR #23141: ext/libxml: php_libxml_node_free_list() stack overflow on deep detach…
| From: | devnexen | Date: | Sat, 08 Aug 2026 09:14:16 +0000 |
| Subject: | [php-src] PR #23141: ext/libxml: php_libxml_node_free_list() stack overflow on deep detach… | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-37651@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23141
Author: devnexen
…ed subtrees.
Fix #23118
php_libxml_node_free_list() iterated over siblings but recursed into node->children, so
destroying a detached subtree nested deeply enough overflowed the C stack. This runs from the object
destructor, where an Error cannot be propagated, so the traversal was made iterative: it walks down
to the deepest freeable node and back up through the parent, keeping xmlRemoveID() in pre-order
because it reads the attribute value out of the attribute's children.