[php-src] PR #23248: Fix DOMNameSpaceNode clone UAF after xinclude
| From: | iliaal | Date: | Thu, 13 Aug 2026 14:13:24 +0000 |
| Subject: | [php-src] PR #23248: Fix DOMNameSpaceNode clone UAF after xinclude | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-37822@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23248
Author: iliaal
DOMNameSpaceNode clone used original_node->parent to build the fake namespace decl. After
DOMDocument::xinclude() that parent is freed. The clone now takes its parent from parent_intern, or
NULL if that wrapper was stripped. parentNode and lookup* still use original_node->parent
(https://github.com/php/php-src/pull/22627).