Skip to content

Commit 3f24420

Browse files
committed
Fix UAF, now leaks memory though :/ Please advise
1 parent 66ed949 commit 3f24420

1 file changed

Lines changed: 2 additions & 0 deletions

File tree

ext/dom/xpath_callbacks.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -440,6 +440,8 @@ static zend_result php_dom_xpath_callback_dispatch(php_dom_xpath_callbacks *xpat
440440
obj = Z_DOMOBJ_P(&callback_retval);
441441
nodep = dom_object_get_node(obj);
442442
valuePush(ctxt, xmlXPathNewNodeSet(nodep));
443+
/* keep document alive */
444+
php_libxml_increment_doc_ref((php_libxml_node_object *) obj, nodep->doc);
443445
} else if (Z_TYPE(callback_retval) == IS_FALSE || Z_TYPE(callback_retval) == IS_TRUE) {
444446
valuePush(ctxt, xmlXPathNewBoolean(Z_TYPE(callback_retval) == IS_TRUE));
445447
} else if (Z_TYPE(callback_retval) == IS_OBJECT) {

0 commit comments

Comments
 (0)