php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #27878 <xsl:include href="file.xsl"> makes Apache crash if file.xsl has errors
Submitted: 2004-04-06 02:48 UTC Modified: 2004-04-07 09:34 UTC
From: fjortiz at comunet dot es Assigned:
Status: Not a bug Package: XSLT related
PHP Version: 5.0.0RC1 OS: Win32
Private report: No CVE-ID: None
View Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
If you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: fjortiz at comunet dot es
New email:
PHP Version: OS:

 

 [2004-04-06 02:48 UTC] fjortiz at comunet dot es
Description:
------------
I guess some extra checks should be added to the (great!) new DOM/XSLT processor. Or maybe it's a libxml crash...

Only happens when the error is in the included file.

Sample XSL below:

file.xsl: see the "&apos;&nbsp;&apos;" at the param "strDelimiter". No crash if select="&apos; &apos;"

<?xml version='1.0' encoding='utf-8' ?>
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0">

	<xsl:output method="xml" indent="yes"/>

	<xsl:template name="Split">
		<xsl:param name="strInput" select="&apos;&apos;"/>
		<xsl:param name="strDelimiter" select="&apos;&nbsp;&apos;"/>
<!-- stripped, enough to see the crash -->
	</xsl:template>

</xsl:stylesheet>

And then drill6.xsl includes file.xsl:

<?xml version="1.0" encoding="utf-8"?>
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0">

	<xsl:output method="xml" indent="yes"/>
	<xsl:include href="file.xsl"/>

	<xsl:template match="/">
		<datos>
			<xsl:call-template name="Split">
				<xsl:with-param name="strInput" select="."/>
				<xsl:with-param name="strDelimiter" select="' '"/>
			</xsl:call-template>
		</datos>
	</xsl:template>
		
</xsl:stylesheet>



Reproduce code:
---------------
<?
header("Content-type: text/xml; charset=ISO-8859-1;") ; 

$xml =& new DomDocument() ; 
$xml->load("datos.xml");

$xsl =& new DomDocument();
$xsl->load("drill6.xsl");
$proc = new xsltprocessor;
$proc->importStylesheet($xsl);
$string = $proc->transformToXml($xml);

print "$string";

?>


Actual result:
--------------
Unhandled exception at 0x009bb86d (php5ts_debug.dll) in Apache.exe: 0xC0000005: Access violation reading location 0xdddddddd.

xsltprocessor.c line 326
sheetp = xsltParseStylesheetDoc(newdoc);

Call Stack:
 	php5ts_debug.dll!_xmlDictFree()  + 0xd	C
 	php5ts_debug.dll!_xmlDictFree()  + 0x29	C
 	php5ts_debug.dll!_xsltFreeStylesheet()  + 0x1a2	C
 	php5ts_debug.dll!_xsltParseStylesheetImportedDoc()  + 0x8f	C
 	php5ts_debug.dll!_xsltParseStylesheetDoc()  + 0xd	C
>	php5ts_debug.dll!zif_xsl_xsltprocessor_import_stylesheet(int ht=1, _zval_struct * return_value=0x02786518, _zval_struct * this_ptr=0x02796030, int return_value_used=0, void * * * tsrm_ls=0x02777440)  Line 326 + 0x9	C
 	php5ts_debug.dll!zend_do_fcall_common_helper(_zend_execute_data * execute_data=0x018ff558, _zend_op * opline=0x02799e98, _zend_op_array * op_array=0x02797bb0, void * * * tsrm_ls=0x02777440)  Line 2665 + 0x32	C
 	php5ts_debug.dll!zend_do_fcall_by_name_handler(_zend_execute_data * execute_data=0x018ff558, _zend_op * opline=0x02799e98, _zend_op_array * op_array=0x02797bb0, void * * * tsrm_ls=0x02777440)  Line 2776 + 0x15	C
 	php5ts_debug.dll!execute(_zend_op_array * op_array=0x02797bb0, void * * * tsrm_ls=0x02777440)  Line 1339 + 0x17	C
 	php5ts_debug.dll!zend_execute_scripts(int type=8, void * * * tsrm_ls=0x02777440, _zval_struct * * retval=0x00000000, int file_count=3, ...)  Line 1046 + 0x21	C
 	php5ts_debug.dll!php_execute_script(_zend_file_handle * primary_file=0x018ffbb0, void * * * tsrm_ls=0x02777440)  Line 1628 + 0x1b	C
 	php5apache.dll!apache_php_module_main(request_rec * r=0x01054068, int display_source_mode=0, void * * * tsrm_ls=0x02777440)  Line 54 + 0x10	C
 	php5apache.dll!send_php(request_rec * r=0x01054068, int display_source_mode=0, char * filename=0x01054bd0)  Line 621 + 0x11	C
 	php5apache.dll!send_parsed_php(request_rec * r=0x01054068)  Line 636 + 0xd	C
 	ApacheCore.dll!6ff64ae7() 	
 	ApacheCore.dll!6ff73f94() 	
 	ApacheCore.dll!6ff73d06() 	
 	ApacheCore.dll!6ff6b8ff() 	
 	msvcrt.dll!780085bc() 	
 	KERNEL32.DLL!7c4e987c() 	


Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2004-04-06 13:38 UTC] rrichards@php.net
I cant reproduce this. What libxml and libxslt versions are you using, where did you get them, how did you build the xsl extension (shared or static) and how did you compile in the libxslt support (static or shared)?
 [2004-04-07 02:39 UTC] fjortiz at comunet dot es
These are the settings:

cscript /nologo configure.js --enable-debug --enable-apache --with-apache-includes="C:\Program Files\Apache Group\Apache\include" --with-apache-libs="C:\Program Files\Apache Group\Apache\lib" --disable-cli --enable-soap=shared --with-mssql=shared --disable-odbc --without-sqlite --without-wddx --with-xsl=../libxslt-1.1.4.win32 --with-dom

Libs versions:
libxslt-1.1.4.win32 --> static 
libxml2-2.6.7.win32 --> static

By the call stack, the crash is at _xmlDictFree in libxml2, so maybe I'm bugging the wrong person...
Let me know if you need any other info.
 [2004-04-07 09:34 UTC] rrichards@php.net
Not a PHP issue. Its a libxml bug which was fixed in 2.6.8. You need to upgrade your libxml libraries.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Dec 26 17:01:31 2024 UTC