diff --git a/ext/dom/php_dom.c b/ext/dom/php_dom.c index 6bc72e9f97940..2f2878d5e1521 100644 --- a/ext/dom/php_dom.c +++ b/ext/dom/php_dom.c @@ -1302,9 +1302,13 @@ int dom_hierarchy(xmlNodePtr parent, xmlNodePtr child) { xmlNodePtr nodep; - if (parent == NULL || child == NULL || child->doc != parent->doc) { - return SUCCESS; - } + if (parent == NULL || child == NULL || child->doc != parent->doc) { + return SUCCESS; + } + + if (child->type == XML_DOCUMENT_NODE) { + return FAILURE; + } nodep = parent; diff --git a/ext/dom/tests/bug66783.phpt b/ext/dom/tests/bug66783.phpt new file mode 100644 index 0000000000000..98981a88f6e26 --- /dev/null +++ b/ext/dom/tests/bug66783.phpt @@ -0,0 +1,19 @@ +--TEST-- +Bug #66783 (UAF when appending DOMDocument to element) +--SKIPIF-- + +--FILE-- +loadXML(''); +$e = $doc->createElement('e'); +try { + $e->appendChild($doc); +} catch (DOMException $ex) { + echo $ex->getMessage(), PHP_EOL; +} +?> +--EXPECTF-- +Hierarchy Request Error