Fix #66783: UAF when appending DOMDocument to element

According to the DOM standard, elements may only contain element, text,
processing instruction and comment nodes[1].  It is also specified that
a HierarchyRequestError should be thrown if a document is to be
inserted[2].  We follow that standard, and prevent the use-after-free
this way.

[1] <https://dom.spec.whatwg.org/#node-trees>
[2] <https://dom.spec.whatwg.org/#mutation-algorithms>

Closes GH-6765.

diff --git a/NEWS b/NEWS
index 2b7c2f91be0f2e01921c86e570411d230e7bcba7..0584f6504c2b8abdaba2669b81568daac2d7272a 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,8 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2021, PHP 7.4.18
 
+- DOM:
+  . Fixed bug #66783 (UAF when appending DOMDocument to element). (cmb)
 
 01 Apr 2021, PHP 7.4.17
 

diff --git a/ext/dom/php_dom.c b/ext/dom/php_dom.c
index 6bc72e9f9794032a20324ced797a4c189595d822..2f2878d5e15212dfe1a3cbb547a5d35130c80a98 100644 (file)
--- a/ext/dom/php_dom.c
+++ b/ext/dom/php_dom.c
@@ -1302,9 +1302,13 @@ int dom_hierarchy(xmlNodePtr parent, xmlNodePtr child)
 {
        xmlNodePtr nodep;
 
-    if (parent == NULL || child == NULL || child->doc != parent->doc) {
-        return SUCCESS;
-    }
+       if (parent == NULL || child == NULL || child->doc != parent->doc) {
+               return SUCCESS;
+       }
+
+       if (child->type == XML_DOCUMENT_NODE) {
+               return FAILURE;
+       }
 
        nodep = parent;
 

diff --git a/ext/dom/tests/bug66783.phpt b/ext/dom/tests/bug66783.phpt
new file mode 100644 (file)
index 0000000..98981a8
--- /dev/null
+++ b/ext/dom/tests/bug66783.phpt
@@ -0,0 +1,19 @@
+--TEST--
+Bug #66783 (UAF when appending DOMDocument to element)
+--SKIPIF--
+<?php
+if (!extension_loaded('dom')) die('skip dom extension not available');
+?>
+--FILE--
+<?php
+$doc = new DomDocument;
+$doc->loadXML('<root></root>');
+$e = $doc->createElement('e');
+try {
+    $e->appendChild($doc);
+} catch (DOMException $ex) {
+    echo $ex->getMessage(), PHP_EOL;
+}
+?>
+--EXPECTF--
+Hierarchy Request Error