[php-src] PR #23341: ext/dom: php_dom_free_templated_content() use-after-free.
| From: | devnexen | Date: | Tue, 18 Aug 2026 04:57:16 +0000 |
| Subject: | [php-src] PR #23341: ext/dom: php_dom_free_templated_content() use-after-free. | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-37957@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23341
Author: devnexen
Fix #gh23334
The fragment was freed with xmlFreeNode(), assuming no userland reference into template contents
could exist. getElementById() reaches those nodes, so freeing the template element left dangling
proxies.
The children now go through php_libxml_node_free_list(), and the fragment is freed only when it has
no proxy; otherwise its parent link is cleared so it is freed with the last reference.