[php-src] PR #23735: ext/dom: DOMXPath::__construct() use-after-free during an evaluation.
| From: | devnexen | Date: | Thu, 17 Sep 2026 18:41:34 +0000 |
| Subject: | [php-src] PR #23735: ext/dom: DOMXPath::__construct() use-after-free during an evaluation. | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-38539@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23735
Author: devnexen
Fix #23729
Reconstructing the object from a php:function callback freed the context libxml2 was still
evaluating, and php_xpath_eval() wrote back into it once the evaluation returned. The evaluation
depth is now tracked on the object and __construct() throws while it is non-zero.