[php-src] PR #25351: ext/dom: Fix use-after-free in getElementById() after removing an ID attribute
| From: | iliaal | Date: | Mon, 09 Nov 2026 20:22:01 +0000 |
| Subject: | [php-src] PR #25351: ext/dom: Fix use-after-free in getElementById() after removing an ID attribute | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-40479@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/25351
Author: iliaal
Freeing a detached ID attribute, for example after removeAttributeNode() and unset(), left the
document's ID table pointing at it, so a later
getElementById() for that ID read
freed memory. php_libxml_node_free_resource() freed the attribute's children before
xmlFreeProp() called xmlRemoveID(), which needs those children to find the entry. Remove the ID
first, as php_libxml_node_free_list() already does.