php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix GH-16595: Another UAF in DOM -> cloneNode

Browse Source 
We need to perform all sanity checks before doing any modification.
I don't have a reliable and easy test for this on 8.2, but I have one
for 8.4.

Closes GH-16598.
This commit is contained in:
Niels Dossche
2024-10-25 19:27:02 +02:00
parent d89dd28d3b
commit 9d8983c061
2 changed files with 10 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
NEWS
View File

@@ -40,6 +40,7 @@ PHP NEWS
an element). (nielsdos)
. Fixed bug GH-16535 (UAF when using document as a child). (nielsdos)
. Fixed bug GH-16593 (Assertion failure in DOM->replaceChild). (nielsdos)
. Fixed bug GH-16595 (Another UAF in DOM -> cloneNode). (nielsdos)
- EXIF:
. Fixed bug GH-16409 (Segfault in exif_thumbnail when not dealing with a

15
ext/dom/node.c
View File

@@ -893,7 +893,7 @@ Since:
PHP_METHOD(DOMNode, insertBefore)
{
zval *id, *node, *ref = NULL;
xmlNodePtr child, new_child, parentp, refp;
xmlNodePtr child, new_child, parentp, refp = NULL;
dom_object *intern, *childobj, *refpobj;
int ret, stricterror;
@@ -918,18 +918,21 @@ PHP_METHOD(DOMNode, insertBefore)
RETURN_FALSE;
}
if (child->doc == NULL && parentp->doc != NULL) {
childobj->document = intern->document;
php_libxml_increment_doc_ref((php_libxml_node_object *)childobj, NULL);
}
/* Fetch and perform sanity checks before modifying reference pointers. */
if (ref != NULL) {
DOM_GET_OBJ(refp, ref, xmlNodePtr, refpobj);
if (refp->parent != parentp) {
php_dom_throw_error(NOT_FOUND_ERR, stricterror);
RETURN_FALSE;
}
}
if (child->doc == NULL && parentp->doc != NULL) {
childobj->document = intern->document;
php_libxml_increment_doc_ref((php_libxml_node_object *)childobj, NULL);
}
if (ref != NULL) {
if (child->parent != NULL) {
xmlUnlinkNode(child);
}