Commit 43c2c77a180 for php

commit 43c2c77a180a095c616654c26600140f1ed3d20e
Merge: 9b3ca2e9e69 0857fdc252a
Author: Jakub Zelenka <bukka@php.net>
Date:   Sun Nov 1 15:13:01 2026 +0100

    Merge branch 'PHP-8.4' into PHP-8.5

    * PHP-8.4:
      Fix UAF in reflected attribute write paths (#25120)

diff --cc NEWS
index 7d47669d454,b2d2ef47260..a72e55a0d7c
--- a/NEWS
+++ b/NEWS
@@@ -59,7 -68,22 +59,9 @@@ PH
      NULL deref on first use after a failed open). (Girgias)

  - DOM:
+   . Fixed a use-after-free when reflected attribute setters replace an
+     attribute whose child still has a live wrapper. (Jakub Zelenka)
 -  . Fixed bug GH-23352 (UAF reading an attribute value node retained across
 -    DOMDocument::adoptNode()). (David Carlier)
 -  . Fixed bug GH-24260 (querySelectorAll() returns duplicate elements for
 -    selector lists). (fivefilters)
 -  . Fixed bug GH-23334 (Use-after-free in php_dom_free_templated_content()).
 -    (David Carlier, ndossche)
 -  . Fixed bug GH-22077 (UAF in custom XPath function). (Joe Afflerbach)
 -  . Fixed bug GH-22554 (use-after-free with XPath callback returning a node
 -    from a foreign document). (David Carlier)
 -  . Fixed DOMXPath crash wrapping a foreign node after a nodeset callback.
 -    (Ilia Alshanetsky)
    . Fix error paths in dom_xml_serializing_a_document_node(). (ndossche)
 -  . Fixed use-after-free on namespace axis results with a foreign-document
 -    XPath callback node. (David Carlier)

  - FFI:
    . Fixed bug GH-24582 (Memory leaks in ext/ffi parser when finalize_type()
diff --cc ext/dom/element.c
index 8dd7f375605,f370b0e958d..260f0f747d5
--- a/ext/dom/element.c
+++ b/ext/dom/element.c
@@@ -156,8 -156,7 +156,8 @@@ static xmlAttrPtr dom_element_reflected

  	/* Typed property, so it is a string already */
  	ZEND_ASSERT(Z_TYPE_P(newval) == IS_STRING);
 +	php_libxml_invalidate_node_list_cache(obj->document);
- 	return xmlSetNsProp(nodep, NULL, (const xmlChar *) name, (const xmlChar *) Z_STRVAL_P(newval));
+ 	return dom_set_attribute_value(nodep, NULL, (const xmlChar *) name, (const xmlChar *) Z_STRVAL_P(newval));
  }

  /* {{{ className	string
diff --cc ext/dom/token_list.c
index 34e2aa6b3ca,b9f3b330b4f..0cb7f0225d9
--- a/ext/dom/token_list.c
+++ b/ext/dom/token_list.c
@@@ -433,8 -382,7 +433,8 @@@ zend_result dom_token_list_value_write(
  		zend_value_error("Value must not contain any null bytes");
  		return FAILURE;
  	}
 +	php_libxml_invalidate_node_list_cache(intern->dom.document);
- 	xmlSetNsProp(dom_token_list_get_element(intern), NULL, BAD_CAST "class", BAD_CAST Z_STRVAL_P(newval));
+ 	dom_set_attribute_value(dom_token_list_get_element(intern), NULL, BAD_CAST "class", BAD_CAST Z_STRVAL_P(newval));
  	/* Note: we don't update the set here, the set is always lazily updated for performance reasons. */
  	return SUCCESS;
  }