Skip to content

ext/dom: fix UAF on namespace axis results with foreign-doc XPath cal… - #24629

Open
devnexen wants to merge 1 commit into
php:PHP-8.4from
devnexen:gh24570_follow_up
Open

devnexen wants to merge 1 commit into
php:PHP-8.4from
devnexen:gh24570_follow_up

Conversation

@devnexen

Copy link
Copy Markdown
Member

…lback nodes

Follow-up to #24570 (comment)

The namespace node branch of php_xpath_eval() still created the parent element with the DOMXPath's own dom, so with a foreign-doc callback node the parent proxy referenced the wrong document. Use dom_xpath_intern_for_doc() there too.

…lback nodes

Follow-up to php#24570 (comment)

The namespace node branch of php_xpath_eval() still created the parent
element with the DOMXPath's own dom, so with a foreign-doc callback node
the parent proxy referenced the wrong document. Use
dom_xpath_intern_for_doc() there too.
@devnexen
devnexen marked this pull request as ready for review October 24, 2026 03:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant