[php-src] PR #23621: dom: clear the xpath callback registrations before freeing them
| From: | iliaal | Date: | Tue, 08 Sep 2026 18:42:36 +0000 |
| Subject: | [php-src] PR #23621: dom: clear the xpath callback registrations before freeing them | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-38393@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23621
Author: iliaal
php_dom_xpath_callbacks_dtor() freed php_ns and each
namespaces entry but left registry->php_ns and
registry->namespaces pointing at the freed memory, and it then destroyed
node_list, which runs node destructors. A destructor that calls
gc_collect_cycles() reaches php_dom_xpath_callback_ns_get_gc() through
those still-set fields and iterates freed memory.
Reachable from userland by calling DOMXPath::__construct() a second time on an object
that already has php:function registrations and a populated node list, which is the
path at ext/dom/xpath.c that tears the registry down on a live object.