[php-src] PR #25358: ext/xsl: Fix use-after-free when an XSLT callback modifies the source document
| From: | iliaal | Date: | Tue, 10 Nov 2026 01:55:03 +0000 |
| Subject: | [php-src] PR #25358: ext/xsl: Fix use-after-free when an XSLT callback modifies the source document | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-40491@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/25358
Author: iliaal
Depends on #25355 and #25357, whose commits this branch carries.
A php:function() callback, entity loader or error handler runs while libxslt walks the source tree,
so modifying that tree frees nodes the transformation still uses. Make the source tree read-only for
every transformation, and protect callback-returned and detached trees as #25357 does for DOMXPath.
ext/xsl/tests/bug69168.phpt and cloneDocument.phpt change because their callbacks modified the
source document; setting cloneDocument to true keeps the original modifiable.