[php-src] PR #23621: dom: clear the xpath callback registrations before freeing them

From: Date: Tue, 08 Sep 2026 18:42:36 +0000
Subject: [php-src] PR #23621: dom: clear the xpath callback registrations before freeing them
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-38393@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/23621 Author: iliaal php_dom_xpath_callbacks_dtor() freed php_ns and each namespaces entry but left registry->php_ns and registry->namespaces pointing at the freed memory, and it then destroyed node_list, which runs node destructors. A destructor that calls gc_collect_cycles() reaches php_dom_xpath_callback_ns_get_gc() through those still-set fields and iterates freed memory. Reachable from userland by calling DOMXPath::__construct() a second time on an object that already has php:function registrations and a populated node list, which is the path at ext/dom/xpath.c that tears the registry down on a live object.

« previous php.git-pulls (#38393) next »