php-src/ext/xml
Christoph M. Becker 0af3f49312 Fix #79922: Crash after multiple calls to xml_parser_free()
We must not call `zend_list_delete()` in resource closer functions
exposed to userland, because decreasing the refcount there leads to
use-after-free scenarios.  In this case, commit 4a42fbb worked for
typical use-cases where `xml_parser_free()` has been called exactly
once for the resource, because there is an internal zval (`->index`)
referencing the same resource which already increased the refcount by
one.  However, when `xml_parser_free()` is called multiple times on the
same XML parser resource, the resource would be freed prematurely.

Instead we forcefully close the resource in `xml_parser_free()`.  We
also could decrease the refcount of the resource there, but that would
require to call `xml_parser_free()` which is somewhat uncommon, and
would be particularly bad wrt. PHP 8 where that function is a NOP, and
as such doesn't have to be called.  So we do no longer increase the
refcount of the resource when copying it to the internal zval, and let
the usualy refcounting semantics take care of the resource destruction.

[1] <http://git.php.net/?p=php-src.git;a=commit;h=4a42fbbbc73aad7427aef5c89974d1833636e082>
2020-08-10 12:23:44 +02:00
..
tests Fix #79922: Crash after multiple calls to xml_parser_free() 2020-08-10 12:23:44 +02:00
compat.c Fix #71592: External entity processing never fails 2018-10-27 17:30:13 +02:00
config.m4 Trim trailing whitespace in source code files 2018-10-13 14:14:50 +02:00
config.w32 Remove unused Git attributes ident 2018-07-25 00:53:25 +02:00
CREDITS
expat_compat.h Merge branch 'PHP-7.2' into PHP-7.3 2018-09-15 13:24:48 +02:00
php_xml.h Trim trailing whitespace in source code files 2018-10-13 14:14:50 +02:00
xml.c Fix #79922: Crash after multiple calls to xml_parser_free() 2020-08-10 12:23:44 +02:00