php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #36776 node_list_wrapper_dtor segfault
Submitted: 2006-03-17 19:44 UTC Modified: 2006-03-18 11:47 UTC
From: rasmus@php.net Assigned:
Status: Closed Package: DOM XML related
PHP Version: 4CVS-2006-03-17 (CVS) OS: Linux
Private report: No CVE-ID: None
View Developer Edit
 [2006-03-17 19:44 UTC] rasmus@php.net 
Description:
------------
It looks like the node_list_wrapper_dtor function gets confused and ends up segfaulting.

Reproduce code:
---------------
<?php
$xml=<<<EOB
<?xml version="1.0" standalone="no"?>
<!DOCTYPE items [
<!ATTLIST items attr CDATA #REQUIRED>
<!ELEMENT item EMPTY>
<!ELEMENT items (item)+>
]>
<items attr="test"><item/> <item/></items>
EOB;
domxml_open_mem($xml);
?>

Expected result:
----------------
no segfault

Actual result:
--------------
segfault

With this backtrace:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1218013504 (LWP 6708)]
0x0809ec35 in node_list_wrapper_dtor (node=0x0, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:645
645     {
(gdb) bt
#0  0x0809ec35 in node_list_wrapper_dtor (node=0x0, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:645
#1  0x0809ec51 in node_list_wrapper_dtor (node=0x82ba970, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:647
#2  0x0809ec8d in node_list_wrapper_dtor (node=0x82bc1e8, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:659
#3  0x0809ec8d in node_list_wrapper_dtor (node=0x82bc1e8, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:659
#4  0x0809ec8d in node_list_wrapper_dtor (node=0x82bc1e8, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:659
#5  0x0809ec8d in node_list_wrapper_dtor (node=0x82bc1e8, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:659
#6  0x0809ec8d in node_list_wrapper_dtor (node=0x82bc1e8, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:659
#7  0x0809ec8d in node_list_wrapper_dtor (node=0x82bc1e8, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:659
#8  0x0809ec8d in node_list_wrapper_dtor (node=0x82bc1e8, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:659
#9  0x0809ec8d in node_list_wrapper_dtor (node=0x82bc1e8, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:659
#10 0x0809ec8d in node_list_wrapper_dtor (node=0x82bc1e8, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:659
...
thousands more lines like the above.

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2006-03-18 11:47 UTC] rrichards@php.net 
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Thu Oct 30 22:00:01 2025 UTC