Repository navigation
Conversation
php_xsl_apply_stylesheet() keeps the transformation's document reference in intern->doc and the callback node wrappers in the processor's node list, so a second transformation on the same processor, started from a php:function() callback or from main code while a Fiber is suspended inside one, freed that state under the running transformation. Throw an Error for such a call, as importStylesheet() already does, and restore transform_depth when a callback bails out so that the processor remains usable in shutdown functions.
A php:function() callback runs while libxml2 builds an XPath node-set, so modifying the tree or dropping the last reference to a detached subtree freed nodes the evaluation still referenced. While DOMXPath or Dom\XPath evaluates with PHP functions registered, the tree of the evaluated document, the tree of every node a callback returned and the detached subtrees of the context node and of callback arguments are read-only: modifying them throws a DOMException with NO_MODIFICATION_ALLOWED_ERR or, through SimpleXML, an Error, and the evaluation keeps those subtrees alive until it ends. New nodes and document properties stay modifiable.
… document A php:function() callback, or an entity loader or error handler, runs while libxslt walks the source tree, so modifying the tree or dropping the last reference to a detached subtree freed nodes the transformation still referenced. Make the source tree read-only for the duration of every transformation, and arm the XPath callback registry so that, as for DOMXPath, the trees of returned nodes and the detached subtrees of the current node and of callback arguments are read-only and kept alive until the transformation ends.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Depends on #25355 and #25357, whose commits this branch carries.
A php:function() callback, entity loader or error handler runs while libxslt walks the source tree, so modifying that tree frees nodes the transformation still uses. Make the source tree read-only for every transformation, and protect callback-returned and detached trees as #25357 does for DOMXPath. ext/xsl/tests/bug69168.phpt and cloneDocument.phpt change because their callbacks modified the source document; setting cloneDocument to true keeps the original modifiable.