[GIT-PULLS] [php-src] PR #23248: Fix DOMNameSpaceNode clone UAF after xinclude
[email protected] (iliaal)
| Newsgroups | php.git-pulls |
|---|---|
| Message-ID | <[email protected]> |
Pull Request: https://github.com/php/php-src/pull/23248 Author: iliaal DOMNameSpaceNode clone used original_node->parent to build the fake namespace decl. After DOMDocument::xinclude() that parent is freed. The clone now takes its parent from parent_intern, or NULL if that wrapper was stripped. parentNode and lookup* still use original_node->parent (https://github.com/php/php-src/pull/22627).