[php-src] PR #25355: ext/xsl: Fix use-after-free on a nested transform of the same processor
| From: | iliaal | Date: | Mon, 09 Nov 2026 22:45:01 +0000 |
| Subject: | [php-src] PR #25355: ext/xsl: Fix use-after-free on a nested transform of the same processor | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-40486@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/25355
Author: iliaal
Starting a second transformation on an XSLTProcessor that is already transforming, from a
php:function() callback or from main code while a Fiber is suspended inside one, overwrote the
processor's document reference and callback node list under the running transformation, which
then read freed memory. Throw an Error for such a call, as importStylesheet() already does. A
callback that bails out also no longer leaves the processor marked as transforming, so it stays
usable in shutdown functions.