Skip to content

Commit 51b642f

Browse files
committed
Fix GH-16535: UAF when using document as a child
Documents can never be children of any node. Closes GH-16539.
1 parent a0a7361 commit 51b642f

File tree

3 files changed

+32
-0
lines changed

3 files changed

+32
-0
lines changed

NEWS

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ PHP NEWS
3232
. Fixed bug GH-16473 (dom_import_simplexml stub is wrong). (nielsdos)
3333
. Fixed bug GH-16533 (Segfault when adding attribute to parent that is not
3434
an element). (nielsdos)
35+
. Fixed bug GH-16535 (UAF when using document as a child). (nielsdos)
3536

3637
- EXIF:
3738
. Fixed bug GH-16409 (Segfault in exif_thumbnail when not dealing with a

ext/dom/node.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -878,6 +878,12 @@ static bool dom_node_check_legacy_insertion_validity(xmlNodePtr parentp, xmlNode
878878
return false;
879879
}
880880

881+
/* Documents can never be a child. */
882+
if (child->type == XML_DOCUMENT_NODE || child->type == XML_HTML_DOCUMENT_NODE) {
883+
php_dom_throw_error(HIERARCHY_REQUEST_ERR, stricterror);
884+
return false;
885+
}
886+
881887
return true;
882888
}
883889

ext/dom/tests/gh16535.phpt

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
--TEST--
2+
GH-16535 (UAF when using document as a child)
3+
--EXTENSIONS--
4+
dom
5+
--FILE--
6+
<?php
7+
8+
$v2 = new DOMDocument("t");
9+
10+
$v2->loadHTML("t");
11+
$v4 = $v2->createElement('foo');
12+
try {
13+
$v4->appendChild($v2);
14+
} catch (DOMException $e) {
15+
echo $e->getMessage(), "\n";
16+
}
17+
$v2->loadHTML("oU");
18+
echo $v2->saveXML();
19+
20+
?>
21+
--EXPECT--
22+
Hierarchy Request Error
23+
<?xml version="1.0" standalone="yes"?>
24+
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
25+
<html><body><p>oU</p></body></html>

0 commit comments

Comments
 (0)