Skip to content

ext/xsl: Fix use-after-free on a nested transform of the same processor - #25355

Open
iliaal wants to merge 1 commit into
php:masterfrom
iliaal:fix/xsl-nested-transform
Open

iliaal wants to merge 1 commit into
php:masterfrom
iliaal:fix/xsl-nested-transform

Conversation

@iliaal

@iliaal iliaal commented Nov 9, 2026 •

Copy link
Copy Markdown
Member

Starting a second transformation on an XSLTProcessor that is already transforming, from a php:function() callback or from main code while a Fiber is suspended inside one, overwrote the processor's document reference and callback node list under the running transformation, which then read freed memory. Throw an Error for such a call, as importStylesheet() already does.

Comment thread ext/xsl/xsltprocessor.c Outdated
} else {
newdocp = xsltApplyStylesheetUser(style, doc, /* params (handled manually) */ NULL, /* output */ NULL, f, ctxt);
zend_try {
newdocp = xsltApplyStylesheetUser(style, doc, NULL, NULL, f, ctxt);

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please keep the inline comments.
Also: how is this bailout triggered in practice?

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Restored. It needs a fatal error inside a php:function() callback (max_execution_time, E_USER_ERROR), after which only shutdown functions could still touch the processor. importStylesheet() already refuses there on master, so I dropped the zend_try rather than chase libxslt's half-built state.

php_xsl_apply_stylesheet() keeps the transformation's document reference in
intern->doc and the callback node wrappers in the processor's node list, so a
second transformation on the same processor, started from a php:function()
callback or from main code while a Fiber is suspended inside one, freed that
state under the running transformation. Throw an Error for such a call, as
importStylesheet() already does.
@iliaal
iliaal force-pushed the fix/xsl-nested-transform branch from e9a2b87 to c9220b1 Compare November 10, 2026 12:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants