[php-src] PR #24764: Fix GH-24763: Clear libxml entity loader before destroying FCC
| From: | thediex | Date: | Mon, 26 Oct 2026 22:24:00 +0000 |
| Subject: | [php-src] PR #24764: Fix GH-24763: Clear libxml entity loader before destroying FCC | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-39942@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24764
Author: thediex
Fixes GH-24763.
A bailout during destruction of
LIBXML(entity_loader_callback) can interrupt
zend_fcc_dtor() before the stored FCC is cleared, leaving the module-global callback in
a stale state.
This change detaches the FCC from LIBXML(entity_loader_callback) before destroying it,
both when replacing the external entity loader and during libxml request shutdown.
A regression test is included.
Validation performed:
- PHP-8.4 unpatched: ASan heap-use-after-free reproduced.
- PHP-8.4 patched: 0/10 ASan UAF reproductions; libxml_get_external_entity_loader()
returned null in all 10 runs.
- Regression test: FAIL on unpatched PHP-8.4, PASS with the fix.
- ext/libxml test suite on patched PHP-8.4: 23 passed, 0 failed, 8 skipped.
- git diff --check: clean.