Repository navigation
ext/dom: UAF node_list_unlink() skips attribute children that still have a live wrapper #23331
Description
Description
Originally reported by @ExPatch-LLC.
The following code:
<?php
$doc = new DOMDocument();
$doc->loadXML('<!DOCTYPE root [<!ENTITY e "X">]><root attr="a&e;b"/>');
$attr = $doc->documentElement->getAttributeNode('attr');
$child = $attr->lastChild;
$doc->documentElement->setAttribute('attr', 'updated');
var_dump($child->nodeType);Produces an UAF.
node_list_unlink() is meant to detach an attribute's children that still have a live PHP wrapper before libxml2 frees them, but it has two exits that abandon the remaining siblings:
xmlUnlinkNode(node)zeroesnode->next, so the loop advancenode = node->nextreadsNULLand stops;- the
breakonXML_ENTITY_REF_NODEleaves the loop entirely rather than just skipping recursion into the entity reference.
Any child past either exit is then freed by xmlSetProp() / xmlSetNsProp() / xmlFreeProp() while its PHP wrapper stays alive, so the wrapper reads freed memory.
PHP Version
Happens on master
Operating System
No response
Activity
Fix phpGH-23331: UAF when an attribute child keeps a live wrapper
Fix phpGH-23331: UAF when an attribute child keeps a live wrapper
Merge branch 'PHP-8.5'
Fix phpGH-23331: UAF when an attribute child keeps a live wrapper
Merge branch 'PHP-8.4' into PHP-8.5