[php-src] PR #25320: Fix GH-25305: NULL dereference in lxb_dom_document_destroy on lexbor …
| From: | devnexen | Date: | Sun, 08 Nov 2026 15:09:36 +0000 |
| Subject: | [php-src] PR #25320: Fix GH-25305: NULL dereference in lxb_dom_document_destroy on lexbor … | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-40433@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/25320
Author: devnexen
…document init failure
lxb_dom_document_init() set owner_document only after all of the document's memory pools were
created. When one of these allocations failed, which the fallible lexbor allocators make possible
once memory_limit is reached, the error path of
lxb_html_document_interface_create() called lxb_dom_document_destroy() with a NULL owner_document
and dereferenced it. The failure path also left dangling pointers to the destroyed pools.
Set owner_document before allocating and reset the pool pointers on failure, carried as a lexbor
patch until lexbor/lexbor#449 is merged. Only the source/lexbor part of the upstream change is
carried.