diff options
| author | Christoph M. Becker <cmbecker69@gmx.de> | 2020-01-29 18:23:51 +0100 |
|---|---|---|
| committer | Christoph M. Becker <cmbecker69@gmx.de> | 2020-01-30 13:04:57 +0100 |
| commit | 8226e704e4e6066a5bd41b57b2934a3371896be2 (patch) | |
| tree | 86fca74729179e8ebda16c108b1068f19579aaea /ext/xsl/xsltprocessor.c | |
| parent | 494615fcb8c1fb5984e0e7d666e51a2dfc6bee55 (diff) | |
| download | php-git-8226e704e4e6066a5bd41b57b2934a3371896be2.tar.gz | |
Fix #70078: XSL callbacks with nodes as parameter leak memory
The fix for bug #49634 solved a double-free by copying the node with
`xmlDocCopyNodeList()`, but the copied node is later freed by calling
`xmlFreeNode()` instead of `xmlFreeNodeList()`, thus leaking memory.
However, there is no need to treat the node as node list, i.e. to copy
also the node's siblings; just creating a recursive copy of the node
with `xmlDocCopyNode()` is sufficient, while that also avoids the leak.
Diffstat (limited to 'ext/xsl/xsltprocessor.c')
| -rw-r--r-- | ext/xsl/xsltprocessor.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/ext/xsl/xsltprocessor.c b/ext/xsl/xsltprocessor.c index accee6c9ac..182aab68d6 100644 --- a/ext/xsl/xsltprocessor.c +++ b/ext/xsl/xsltprocessor.c @@ -274,7 +274,7 @@ static void xsl_ext_function_php(xmlXPathParserContextPtr ctxt, int nargs, int t node->parent = nsparent; node->ns = curns; } else { - node = xmlDocCopyNodeList(domintern->document->ptr, node); + node = xmlDocCopyNode(node, domintern->document->ptr, 1); } php_dom_create_object(node, &child, domintern); |