1--TEST-- 2GH-16595 (Another UAF in DOM -> cloneNode) 3--EXTENSIONS-- 4dom 5--CREDITS-- 6chibinz 7--FILE-- 8<?php 9$v0 = new DOMElement ( "jg" ); 10$v1 = new DOMDocument ( "Zb" ); 11$v2 = new DOMElement ( "IU" ); 12$v7 = new DOMElement ( "L" , null , "df" ); 13$v9 = new DOMDocument ( ); 14 15try { $v1 -> insertBefore ( $v0 , $v9 ); } catch (\Throwable) { } 16$v0 -> replaceChildren ( $v7 ); 17$v7 -> before ( $v2 ); 18$v1 -> insertBefore ( $v0 ); 19$v2 -> cloneNode ( ); 20echo $v1->saveXML(); 21echo $v9->saveXML(); 22?> 23--EXPECT-- 24<?xml version="Zb"?> 25<jg xmlns:default="df"><IU/><default:L xmlns="df"/></jg> 26<?xml version="1.0"?> 27
