[php-src] PR #25120: Fix UAF in reflected attribute write paths
| From: | bukka | Date: | Sun, 01 Nov 2026 10:49:25 +0000 |
| Subject: | [php-src] PR #25120: Fix UAF in reflected attribute write paths | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-40170@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/25120
Author: bukka
Reflected className/id writes and TokenList mutations call xmlSetNsProp(), which frees an existing
attribute child list. Unlink live child wrappers before replacement, following GH-23348.