[GIT-PULLS] [php-src] PR #23341: ext/dom: php_dom_free_templated_content() use-after-free.

[email protected] (devnexen)
Newsgroups php.git-pulls
Message-ID <[email protected]> 
Pull Request: https://github.com/php/php-src/pull/23341
Author: devnexen

Fix #gh23334

The fragment was freed with xmlFreeNode(), assuming no userland reference into template contents could exist. getElementById() reaches those nodes, so freeing the template element left dangling proxies.

The children now go through php_libxml_node_free_list(), and the fragment is freed only when it has no proxy; otherwise its parent link is cleared so it is freed with the last reference.
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.