Skip to content

Commit b599b94

Browse files
committed
fix: null pointer dereference and memory leak
CLA: trivial
1 parent cb63e4f commit b599b94

1 file changed

Lines changed: 9 additions & 3 deletions

File tree

ext/dom/php_dom.c

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -648,9 +648,11 @@ static zend_object *dom_objects_store_clone_obj(zend_object *zobject) /* {{{ */
648648
xmlNodePtr node = (xmlNodePtr)dom_object_get_node(intern);
649649
if (node != NULL) {
650650
php_dom_private_data *private_data = NULL;
651+
bool private_data_created = false;
651652
if (php_dom_follow_spec_intern(intern)) {
652653
if (node->type == XML_DOCUMENT_NODE || node->type == XML_HTML_DOCUMENT_NODE) {
653654
private_data = php_dom_private_data_create();
655+
private_data_created = true;
654656
} else {
655657
private_data = php_dom_get_private_data(intern);
656658
}
@@ -659,9 +661,13 @@ static zend_object *dom_objects_store_clone_obj(zend_object *zobject) /* {{{ */
659661
xmlNodePtr cloned_node = dom_clone_node(php_dom_ns_mapper_from_private(private_data), node, node->doc, true);
660662
if (cloned_node != NULL) {
661663
dom_update_refcount_after_clone(intern, node, clone, cloned_node);
662-
}
663-
if (private_data != NULL) {
664-
clone->document->private_data = php_dom_libxml_private_data_header(private_data);
664+
if (private_data != NULL && clone->document != NULL) {
665+
clone->document->private_data = php_dom_libxml_private_data_header(private_data);
666+
}
667+
} else {
668+
if (private_data_created && private_data != NULL) {
669+
php_dom_private_data_destroy(private_data);
670+
}
665671
}
666672
}
667673
}

0 commit comments

Comments
 (0)