Fix #70078: XSL callbacks with nodes as parameter leak memory#5130
Closed
cmb69 wants to merge 1 commit intophp:PHP-7.3from
Closed
Fix #70078: XSL callbacks with nodes as parameter leak memory#5130cmb69 wants to merge 1 commit intophp:PHP-7.3from
cmb69 wants to merge 1 commit intophp:PHP-7.3from
Conversation
The fix for bug #49634 solved a double-free by copying the node with `xmlDocCopyNodeList()`, but the copied node is later freed by calling `xmlFreeNode()` instead of `xmlFreeNodeList()`, thus leaking memory. However, there is no need to treat the node as node list, i.e. to copy also the node's siblings; just creating a recursive copy of the node with `xmlDocCopyNode()` is sufficient, while that also avoids the leak.
Member
Author
|
@m6w6, what do you think? |
Contributor
|
@cmb69: Cool tnx :-) ... By the way: I never understood, why a recursive copy is made here at all ... this is also a performance issue when passing a bigger tree into a PHP function. In Bug #49634 it is not described, why this was made. But the comments describe the performance problem, too, after the fix. |
Member
Author
|
@not-implemented, I first tried a shallow copy, but that caused xslt011.phpt to fail (the |
Contributor
|
@cmb69: Ah okay, cool. Then this should be fine :-) Many thanks. |
Contributor
|
Awesome, LGTM! |
nikic
approved these changes
Jan 30, 2020
Member
Author
|
Thanks! Applied as 8226e70. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The fix for bug #49634 solved a double-free by copying the node with
xmlDocCopyNodeList(), but the copied node is later freed by callingxmlFreeNode()instead ofxmlFreeNodeList(), thus leaking memory.However, there is no need to treat the node as node list, i.e. to copy
also the node's siblings; just creating a recursive copy of the node
with
xmlDocCopyNode()is sufficient, while that also avoids the leak.