From e5623ea1e93030b6628b4374f455bc5a62eeebbb Mon Sep 17 00:00:00 2001 From: David Carlier Date: Tue, 7 Jul 2026 13:15:55 +0100 Subject: [PATCH 1/3] ext/dom: use-after-free via DOMNameSpaceNode after DOMDocument::xinclude(). Fix GH-22624 Close GH-22627 --- NEWS | 4 ++++ ext/dom/node.c | 19 ++++++++++++++++-- ext/dom/tests/gh22624.phpt | 41 ++++++++++++++++++++++++++++++++++++++ 3 files changed, 62 insertions(+), 2 deletions(-) create mode 100644 ext/dom/tests/gh22624.phpt diff --git a/NEWS b/NEWS index 1bba6a7b6c22..9977ea3b3409 100644 --- a/NEWS +++ b/NEWS @@ -9,6 +9,10 @@ PHP NEWS class constants via OBJ->prop = $val). (Khaled Alam) . Reverted GH-22833, which attempted to fix bug GH-18985. (ilutov) +- DOM: + . Fixed bug GH-22624 (use-after-free via DOMNameSpaceNode after + DOMDocument::xinclude()). (David Carlier) + - PDO_PGSQL: . Fixed several lazy fetch (PDO::ATTR_PREFETCH => 0) defects: an infinite loop when cleaning up a fetch left in a COPY, a use-after-free when a diff --git a/ext/dom/node.c b/ext/dom/node.c index cc063df66960..362000792f1a 100644 --- a/ext/dom/node.c +++ b/ext/dom/node.c @@ -245,11 +245,21 @@ zend_result dom_node_node_type_read(dom_object *obj, zval *retval) /* }}} */ +static xmlNodePtr dom_node_get_parent(dom_object *obj, xmlNodePtr nodep) +{ + if (nodep->type == XML_NAMESPACE_DECL) { + dom_object_namespace_node *ns = php_dom_namespace_node_obj_from_obj(&obj->std); + return ns->parent_intern ? dom_object_get_node(ns->parent_intern) : NULL; + } + return nodep->parent; +} + + static zend_result dom_node_parent_get(dom_object *obj, zval *retval, bool only_element) { DOM_PROP_NODE(xmlNodePtr, nodep, obj); - xmlNodePtr nodeparent = nodep->parent; + xmlNodePtr nodeparent = dom_node_get_parent(obj, nodep); if (!nodeparent || (only_element && nodeparent->type != XML_ELEMENT_NODE)) { ZVAL_NULL(retval); return SUCCESS; @@ -457,7 +467,12 @@ URL: https://dom.spec.whatwg.org/#dom-node-isconnected zend_result dom_node_is_connected_read(dom_object *obj, zval *retval) { DOM_PROP_NODE(xmlNodePtr, nodep, obj); - ZVAL_BOOL(retval, php_dom_is_node_connected(nodep)); + if (nodep->type == XML_NAMESPACE_DECL) { + xmlNodePtr parent = dom_node_get_parent(obj, nodep); + ZVAL_BOOL(retval, parent && php_dom_is_node_connected(parent)); + } else { + ZVAL_BOOL(retval, php_dom_is_node_connected(nodep)); + } return SUCCESS; } /* }}} */ diff --git a/ext/dom/tests/gh22624.phpt b/ext/dom/tests/gh22624.phpt new file mode 100644 index 000000000000..cab2ada76cfc --- /dev/null +++ b/ext/dom/tests/gh22624.phpt @@ -0,0 +1,41 @@ +--TEST-- +GH-22624 (Use-after-free via DOMNameSpaceNode after DOMDocument::xinclude()) +--CREDITS-- +ExPatch-LLC +--EXTENSIONS-- +dom +--SKIPIF-- + +--FILE-- +'); +$href = 'file:///' . ltrim(str_replace('\\', '/', $included), '/'); + +$doc = new DOMDocument(); +$doc->loadXML(' + + +'); + +$xpath = new DOMXPath($doc); +$xpath->registerNamespace('xi', 'http://www.w3.org/2001/XInclude'); +$xi = $xpath->query('//xi:include')->item(0); +$ns = $xpath->query('namespace::local', $xi)->item(0); // DOMNameSpaceNode + +$doc->xinclude(); // frees the xi:include element + +var_dump($ns->parentNode); +var_dump($ns->parentElement); +var_dump($ns->isConnected); +?> +--CLEAN-- + +--EXPECT-- +NULL +NULL +bool(false) From d9c58ee8a2270b4c139a40001d75d31bd197217e Mon Sep 17 00:00:00 2001 From: Weilin Du Date: Mon, 17 Aug 2026 01:03:41 +0800 Subject: [PATCH 2/3] ext/zip: Fix AES-192 and AES-256 support reporting in phpinfo() (#23319) Fixed phpinfo() reporting AES-192 and AES-256 encryption support based on AES-128 support. --- ext/zip/php_zip.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ext/zip/php_zip.c b/ext/zip/php_zip.c index 3d6abde1c312..5330d78b36b0 100644 --- a/ext/zip/php_zip.c +++ b/ext/zip/php_zip.c @@ -3321,9 +3321,9 @@ static PHP_MINFO_FUNCTION(zip) php_info_print_table_row(2, "AES-128 encryption", zip_encryption_method_supported(ZIP_EM_AES_128, 1) ? "Yes" : "No"); php_info_print_table_row(2, "AES-192 encryption", - zip_encryption_method_supported(ZIP_EM_AES_128, 1) ? "Yes" : "No"); + zip_encryption_method_supported(ZIP_EM_AES_192, 1) ? "Yes" : "No"); php_info_print_table_row(2, "AES-256 encryption", - zip_encryption_method_supported(ZIP_EM_AES_128, 1) ? "Yes" : "No"); + zip_encryption_method_supported(ZIP_EM_AES_256, 1) ? "Yes" : "No"); #endif php_info_print_table_end(); From 5e5839904f57f5dabaad28d447b74aea798d79e9 Mon Sep 17 00:00:00 2001 From: Sjoerd Langkemper Date: Sun, 16 Aug 2026 20:51:14 +0200 Subject: [PATCH 3/3] ext/curl: set curl post size using CURLOPT_POSTFIELDSIZE_LARGE (#22842) This is a 64-bit number on all platforms. This improves support of posting files larger than 2GB. - https://curl.se/libcurl/c/CURLOPT_POSTFIELDSIZE.html - https://curl.se/libcurl/c/CURLOPT_POSTFIELDSIZE_LARGE.html --- NEWS | 5 ++++ ext/curl/interface.c | 4 +-- ext/curl/tests/curl_post_large_string.phpt | 30 ++++++++++++++++++++++ 3 files changed, 37 insertions(+), 2 deletions(-) create mode 100644 ext/curl/tests/curl_post_large_string.phpt diff --git a/NEWS b/NEWS index 9977ea3b3409..a75d304276f3 100644 --- a/NEWS +++ b/NEWS @@ -9,6 +9,11 @@ PHP NEWS class constants via OBJ->prop = $val). (Khaled Alam) . Reverted GH-22833, which attempted to fix bug GH-18985. (ilutov) +- Curl: + . Set content length using CURLOPT_POSTFIELDSIZE_LARGE instead of + CURLOPT_POSTFIELDSIZE. This makes it possible to post strings larger than + 2GB on some platforms, e.g. Windows. (Sjoerd Langkemper) + - DOM: . Fixed bug GH-22624 (use-after-free via DOMNameSpaceNode after DOMDocument::xinclude()). (David Carlier) diff --git a/ext/curl/interface.c b/ext/curl/interface.c index e198b0bb7d77..db3dd01b5505 100644 --- a/ext/curl/interface.c +++ b/ext/curl/interface.c @@ -2178,7 +2178,7 @@ static zend_result _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue /* no need to build the mime structure for empty hashtables; also works around https://github.com/curl/curl/issues/6455 */ curl_easy_setopt(ch->cp, CURLOPT_POSTFIELDS, ""); - error = curl_easy_setopt(ch->cp, CURLOPT_POSTFIELDSIZE, 0L); + error = curl_easy_setopt(ch->cp, CURLOPT_POSTFIELDSIZE_LARGE, (curl_off_t) 0); } else { return build_mime_structure_from_hash(ch, zvalue); } @@ -2186,7 +2186,7 @@ static zend_result _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue zend_string *tmp_str; zend_string *str = zval_get_tmp_string(zvalue, &tmp_str); /* with curl 7.17.0 and later, we can use COPYPOSTFIELDS, but we have to provide size before */ - error = curl_easy_setopt(ch->cp, CURLOPT_POSTFIELDSIZE, ZSTR_LEN(str)); + error = curl_easy_setopt(ch->cp, CURLOPT_POSTFIELDSIZE_LARGE, (curl_off_t) ZSTR_LEN(str)); error = curl_easy_setopt(ch->cp, CURLOPT_COPYPOSTFIELDS, ZSTR_VAL(str)); zend_tmp_string_release(tmp_str); } diff --git a/ext/curl/tests/curl_post_large_string.phpt b/ext/curl/tests/curl_post_large_string.phpt new file mode 100644 index 000000000000..b6bc67825428 --- /dev/null +++ b/ext/curl/tests/curl_post_large_string.phpt @@ -0,0 +1,30 @@ +--TEST-- +CURL post data larger than 2GB (to test CURLOPT_POSTFIELDSIZE_LARGE) +--INI-- +memory_limit=3G +--SKIPIF-- + +--EXTENSIONS-- +curl +--FILE-- + true, + CURLOPT_POST => true, + CURLOPT_POSTFIELDS => $data, +]); + +$response = curl_exec($ch); +var_dump($response); + +?> +--EXPECT-- +string(28) "Content-length: =2147483748="