Description
Create included.xml:
<?xml version="1.0"?><included/>
Then run:
<?php
$doc = new DOMDocument();
$doc->loadXML('<?xml version="1.0"?>
<root xmlns:xi="http://www.w3.org/2001/XInclude">
<xi:include href="included.xml" xmlns:local="urn:test"/>
</root>');
$xpath = new DOMXPath($doc);
$xpath->registerNamespace('xi', 'http://www.w3.org/2001/XInclude');
$xi = $xpath->query('//xi:include')->item(0);
$ns = $xpath->query('namespace::local', $xi)->item(0); // DOMNameSpaceNode
$doc->xinclude(); // frees the xi:include element
var_dump($ns->parentNode); // heap-use-after-freedom_xinclude_strip_references() invalidates element and attribute wrappers (it walks children and properties), but DOMNameSpaceNode wraps a synthetic node held only by userland, which that walk never reaches, so it is never invalidated.
This is the same class as the element fix for GH-17847 and the later attribute fix, applied to the namespace-node case that neither covered.
Originally reported by @ExPatch-LLC.
PHP Version
Operating System
No response
Description
Create
included.xml:Then run:
dom_xinclude_strip_references()invalidates element and attribute wrappers (it walkschildrenandproperties), butDOMNameSpaceNodewraps a synthetic node held only by userland, which that walk never reaches, so it is never invalidated.This is the same class as the element fix for GH-17847 and the later attribute fix, applied to the namespace-node case that neither covered.
Originally reported by @ExPatch-LLC.
PHP Version
Operating System
No response