PHP：サービス停止

**Researcher: Nikita Sveshnikov (Positive Technologies)** In `DOMNode::C14N()`, improper removal of a `xmlns` libxml2 attribute from a doubly linked list can lead to a corrupt, circular linked list. The linked list is iterated in many places in PHP and libxml2, leading to DoS through segfaults, or temporal and spatial resource starvation. ```php $doc = Dom\HTMLDocument::createFromString('<svg foo="foo" xmlns="" bar="bar">'); $doc->C14N(); // Segfault on cleanup // Or $doc = Dom\HTMLDocument::createFromString('<svg foo="foo" xmlns="" bar="bar">'); $doc->C14N(); $svg = $doc->documentElement->childNodes[1]->childNodes[0]; foreach ($svg->attributes as $prop) {} // This will loop forever ``` The attribute is removed incorrectly here: https://github.com/php/php-src/blob/f0f28b763c8696511c3b80fb8b25ae8765b2d94b/ext/dom/node.c#L2134-L2141 Notice the `attr->prev = attr->next;` instead of `attr->prev->next = attr->next;`. The attribute is later (correctly) restored here: https://github.com/php/php-src/blob/f0f28b763c8696511c3b80fb8b25ae8765b2d94b/ext/dom/node.c#L2182-L2189 After both procedures, the following graph: ```mermaid flowchart TD A -- "Next" --> xmlns xmlns -- "Prev" --> A xmlns -- "Next" --> B B -- "Prev" --> xmlns ``` Would result in this graph: ```mermaid flowchart TD A -- "Next" --> xmlns xmlns -- "Prev" --> B xmlns -- "Next" --> B B -- "Prev" --> xmlns B -- "Next" --> xmlns ``` Continuously following `next` will result in an infinite loop.