|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
[2006-08-05 20:08 UTC] judas dot iscariote at gmail dot com
[2006-08-06 17:41 UTC] tony2001@php.net
|
|||||||||||||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Thu Oct 30 22:00:01 2025 UTC |
Description: ------------ I am using PHP CLI on SuSE Linux 9.2 and the following code produces a segmentation fault calling the php file with "/usr/bin/php test.php". The element "$xml->unknown" used for calling the function iterate() does not really exist. It seems the function "sxe_find_element_by_name()" in "simplexml.c" returns a null pointer for "orgnode" and then "orgnode->children" is a very dangerous access (see backtrace). configure: ./configure --prefix=/usr/local/php5 --with-apxs2=/usr/sbin/apxs2 --with-libxml-dir=/usr/lib --with-zlib --with-zlib-dir=/usr/lib --with-mysql=/usr/bin/mysql --with-gd --enable-sockets --with-gettext=/usr/bin/gettext --with-jpeg-dir=/usr/bin --with-png-dir=/usr/lib --with-freetype-dir=/usr/lib Reproduce code: --------------- <?php function iterate($xml) { print_r($xml); foreach ($xml->item as $item) { echo "This code will crash!"; } } $xmlstr = "<xml><item>Item 1</item><item>Item 2</item></xml>"; $xml = simplexml_load_string($xmlstr); iterate($xml->unknown); ?> Expected result: ---------------- Error or warning but not a segmentation fault. Actual result: -------------- Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 1077766880 (LWP 10600)] sxe_property_get_adr (object=0x403e2458, member=0x403e3dfc) at /usr/local/src/php5.2-200608051230/ext/simplexml/simplexml.c:198 198 node = orgnode->children; (gdb) bt #0 sxe_property_get_adr (object=0x403e2458, member=0x403e3dfc) at /usr/local/src/php5.2-200608051230/ext/simplexml/simplexml.c:198 #1 0x08247209 in zend_fetch_property_address (result=0xbfffcd90, container_ptr=0x403e4474, prop_ptr=0x403e3dfc, type=1) at /usr/local/src/php5.2-200608051230/Zend/zend_execute.c:1264 #2 0x0824ac88 in ZEND_FETCH_OBJ_W_SPEC_CV_CONST_HANDLER (execute_data=0xbfffcdf0) at /usr/local/src/php5.2-200608051230/Zend/zend_execute.c:271 #3 0x08278239 in execute (op_array=0x843c810) at zend_vm_execute.h:92 #4 0x0822dde9 in zend_do_fcall_common_helper_SPEC (execute_data=0xbfffcf40) at zend_vm_execute.h:234 #5 0x08278239 in execute (op_array=0x403e2908) at zend_vm_execute.h:92 #6 0x0821373f in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /usr/local/src/php5.2-200608051230/Zend/zend.c:1095 #7 0x081dbab9 in php_execute_script (primary_file=0xbffff410) at /usr/local/src/php5.2-200608051230/main/main.c:1759 #8 0x08279650 in main (argc=2, argv=0xbffff4e4) at /usr/local/src/php5.2-200608051230/sapi/cli/php_cli.c:1097