diff --git a/ext/dom/node.c b/ext/dom/node.c index bb80408f2689f..cddb7cf57ac3a 100644 --- a/ext/dom/node.c +++ b/ext/dom/node.c @@ -873,6 +873,12 @@ static bool dom_node_check_legacy_insertion_validity(xmlNodePtr parentp, xmlNode return false; } + /* Documents can never be a child. */ + if (child->type == XML_DOCUMENT_NODE || child->type == XML_HTML_DOCUMENT_NODE) { + php_dom_throw_error(HIERARCHY_REQUEST_ERR, stricterror); + return false; + } + return true; } diff --git a/ext/dom/tests/gh16535.phpt b/ext/dom/tests/gh16535.phpt new file mode 100644 index 0000000000000..1c8d282303c88 --- /dev/null +++ b/ext/dom/tests/gh16535.phpt @@ -0,0 +1,25 @@ +--TEST-- +GH-16535 (UAF when using document as a child) +--EXTENSIONS-- +dom +--FILE-- +loadHTML("t"); +$v4 = $v2->createElement('foo'); +try { + $v4->appendChild($v2); +} catch (DOMException $e) { + echo $e->getMessage(), "\n"; +} +$v2->loadHTML("oU"); +echo $v2->saveXML(); + +?> +--EXPECT-- +Hierarchy Request Error + + +

oU