Skip to content

Fix GH-21952: UAF in DOMNotation after DOCTYPE removal. #21955

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
devnexen wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Fix GH-21952: UAF in DOMNotation after DOCTYPE removal. #21955

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
dbecba4
Fix GH-21952: UAF in DOMNotation after DOCTYPE removal.
devnexen May 5, 2026
4b79859
While at it, register Dom\Notation under its own property handler table.
devnexen May 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions NEWS
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,8 @@ PHP NEWS
ownerDocument, parentNode, isConnected and baseURI now return correct
values, and textContent returns NULL per the DOM specification.
(jordikroon)
. Fixed bug GH-21952 (UAF in php_dom_object_get_data when DOMNotation
outlives owning DOCTYPE). (David Carlier)

- Fileinfo:
. Fixed bug GH-20679 (finfo_file() doesn't work on remote resources).
Expand Down
4 changes: 4 additions & 0 deletions UPGRADING
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,10 @@ PHP 8.6 UPGRADE NOTES
from global scope" instead of the prior readonly modification error.
ReflectionProperty::isWritable() also reports these properties
accurately.
. Dom\Notation and DOMNotation: $parentNode now returns null and
$isConnected returns false, matching the W3C DOM Level 3 Core
specification. The previous wiring caused a use-after-free when the
owning DocType was removed.

- GD:
. imagesetstyle(), imagefilter() and imagecrop() filter their
Expand Down
5 changes: 4 additions & 1 deletion ext/dom/dom_iterators.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,10 @@ xmlNodePtr create_notation(xmlDtdPtr parent_dtd, const xmlChar *name, const xmlC
ret->ExternalID = xmlStrdup(ExternalID);
ret->SystemID = xmlStrdup(SystemID);
if (parent_dtd != NULL) {
ret->parent = parent_dtd;
/* Don't store parent_dtd: orphan notation can outlive the DTD when
* removeChild($doctype) frees it. parentNode/isConnected return spec-
* mandated null/false unconditionally; ownerDocument keeps working
* via ret->doc. */
ret->doc = parent_dtd->doc;
}
return (xmlNodePtr) ret;
Expand Down
2 changes: 2 additions & 0 deletions ext/dom/dom_properties.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,6 +147,8 @@ zend_result dom_nodelist_length_read(dom_object *obj, zval *retval);
/* notation properties */
zend_result dom_notation_public_id_read(dom_object *obj, zval *retval);
zend_result dom_notation_system_id_read(dom_object *obj, zval *retval);
zend_result dom_notation_parent_node_read(dom_object *obj, zval *retval);
zend_result dom_notation_is_connected_read(dom_object *obj, zval *retval);

/* processinginstruction properties */
zend_result dom_processinginstruction_target_read(dom_object *obj, zval *retval);
Expand Down
13 changes: 13 additions & 0 deletions ext/dom/notation.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,4 +69,17 @@ zend_result dom_notation_system_id_read(dom_object *obj, zval *retval)

/* }}} */

zend_result dom_notation_parent_node_read(dom_object *obj, zval *retval)
{
DOM_PROP_NODE(xmlNodePtr, nodep, obj);
ZVAL_NULL(retval);
return SUCCESS;
}

zend_result dom_notation_is_connected_read(dom_object *obj, zval *retval)
{
DOM_PROP_NODE(xmlNodePtr, nodep, obj);
ZVAL_FALSE(retval);
return SUCCESS;
}
#endif
6 changes: 5 additions & 1 deletion ext/dom/php_dom.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1250,6 +1250,8 @@ PHP_MINIT_FUNCTION(dom)
DOM_REGISTER_PROP_HANDLER(&dom_notation_prop_handlers, "publicId", dom_notation_public_id_read, NULL);
DOM_REGISTER_PROP_HANDLER(&dom_notation_prop_handlers, "systemId", dom_notation_system_id_read, NULL);
zend_hash_merge(&dom_notation_prop_handlers, &dom_node_prop_handlers, NULL, false);
DOM_OVERWRITE_PROP_HANDLER(&dom_notation_prop_handlers, "parentNode", dom_notation_parent_node_read, NULL);
DOM_OVERWRITE_PROP_HANDLER(&dom_notation_prop_handlers, "isConnected", dom_notation_is_connected_read, NULL);
zend_hash_add_new_ptr(&classes, dom_notation_class_entry->name, &dom_notation_prop_handlers);

dom_modern_notation_class_entry = register_class_Dom_Notation(dom_modern_node_class_entry);
Expand All @@ -1260,7 +1262,9 @@ PHP_MINIT_FUNCTION(dom)
DOM_REGISTER_PROP_HANDLER(&dom_modern_notation_prop_handlers, "publicId", dom_notation_public_id_read, NULL);
DOM_REGISTER_PROP_HANDLER(&dom_modern_notation_prop_handlers, "systemId", dom_notation_system_id_read, NULL);
zend_hash_merge(&dom_modern_notation_prop_handlers, &dom_modern_node_prop_handlers, NULL, false);
zend_hash_add_new_ptr(&classes, dom_modern_notation_class_entry->name, &dom_modern_node_prop_handlers);
DOM_OVERWRITE_PROP_HANDLER(&dom_modern_notation_prop_handlers, "parentNode", dom_notation_parent_node_read, NULL);
DOM_OVERWRITE_PROP_HANDLER(&dom_modern_notation_prop_handlers, "isConnected", dom_notation_is_connected_read, NULL);
zend_hash_add_new_ptr(&classes, dom_modern_notation_class_entry->name, &dom_modern_notation_prop_handlers);

dom_entity_class_entry = register_class_DOMEntity(dom_node_class_entry);
dom_entity_class_entry->create_object = dom_objects_new;
Expand Down
29 changes: 29 additions & 0 deletions ext/dom/tests/gh21952.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
--TEST--
GH-21952 (UAF in php_dom_object_get_data when DOMNotation outlives owning DOCTYPE)
--EXTENSIONS--
dom
--FILE--
<?php
$doc = new DOMDocument;
$doc->loadXML(<<<'XML'
<!DOCTYPE books [
<!NOTATION myNotation SYSTEM "test.dtd">
]>
<container/>
XML);
$notation = $doc->doctype->notations[0];
var_dump($notation->parentNode);
var_dump($notation->isConnected);
$doc->removeChild($doc->doctype);
var_dump($notation->nodeName);
var_dump($notation->systemId);
var_dump($notation->parentNode);
var_dump($notation->isConnected);
?>
--EXPECT--
NULL
bool(false)
string(10) "myNotation"
string(8) "test.dtd"
NULL
bool(false)
10 changes: 7 additions & 3 deletions ext/dom/tests/modern/xml/DTDNamedNodeMap.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,19 +141,23 @@ object(Dom\Entity)#3 (17) {
["textContent"]=>
NULL
}
object(Dom\Notation)#4 (14) {
object(Dom\Notation)#4 (16) {
["publicId"]=>
string(0) ""
["systemId"]=>
string(11) "viewgif.exe"
["nodeType"]=>
int(12)
["nodeName"]=>
string(3) "GIF"
["baseURI"]=>
string(%d) "%s"
["isConnected"]=>
bool(true)
bool(false)
["ownerDocument"]=>
string(22) "(object value omitted)"
["parentNode"]=>
string(22) "(object value omitted)"
NULL
["parentElement"]=>
NULL
["childNodes"]=>
Expand Down
24 changes: 12 additions & 12 deletions ext/dom/tests/modern/xml/XMLDocument_node_notation_wiring.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,47 +55,47 @@ XML;
string(3) "GIF"
NULL
NULL
bool(false)
bool(true)
bool(true)
bool(true)
bool(false)
NULL
string(3) "GIF"
NULL
NULL
bool(false)
bool(true)
bool(true)
bool(true)
bool(false)
NULL
bool(true)
=== JPEG ===
string(4) "JPEG"
NULL
NULL
bool(false)
bool(true)
bool(true)
bool(true)
bool(false)
NULL
string(4) "JPEG"
NULL
NULL
bool(false)
bool(true)
bool(true)
bool(true)
bool(false)
NULL
bool(true)
=== HTML ===
string(4) "HTML"
NULL
NULL
bool(false)
bool(true)
bool(true)
bool(true)
bool(false)
NULL
string(4) "HTML"
NULL
NULL
bool(false)
bool(true)
bool(true)
bool(true)
bool(false)
NULL
bool(true)
Loading