php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #36776 node_list_wrapper_dtor segfault
Submitted: 2006-03-17 19:44 UTC Modified: 2006-03-18 11:47 UTC
From: rasmus@php.net Assigned:
Status: Closed Package: DOM XML related
PHP Version: 4CVS-2006-03-17 (CVS) OS: Linux
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: rasmus@php.net
New email:
PHP Version: OS:

 

 [2006-03-17 19:44 UTC] rasmus@php.net 
Description:
------------
It looks like the node_list_wrapper_dtor function gets confused and ends up segfaulting.

Reproduce code:
---------------
<?php
$xml=<<<EOB
<?xml version="1.0" standalone="no"?>
<!DOCTYPE items [
<!ATTLIST items attr CDATA #REQUIRED>
<!ELEMENT item EMPTY>
<!ELEMENT items (item)+>
]>
<items attr="test"><item/> <item/></items>
EOB;
domxml_open_mem($xml);
?>

Expected result:
----------------
no segfault

Actual result:
--------------
segfault

With this backtrace:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1218013504 (LWP 6708)]
0x0809ec35 in node_list_wrapper_dtor (node=0x0, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:645
645     {
(gdb) bt
#0  0x0809ec35 in node_list_wrapper_dtor (node=0x0, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:645
#1  0x0809ec51 in node_list_wrapper_dtor (node=0x82ba970, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:647
#2  0x0809ec8d in node_list_wrapper_dtor (node=0x82bc1e8, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:659
#3  0x0809ec8d in node_list_wrapper_dtor (node=0x82bc1e8, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:659
#4  0x0809ec8d in node_list_wrapper_dtor (node=0x82bc1e8, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:659
#5  0x0809ec8d in node_list_wrapper_dtor (node=0x82bc1e8, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:659
#6  0x0809ec8d in node_list_wrapper_dtor (node=0x82bc1e8, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:659
#7  0x0809ec8d in node_list_wrapper_dtor (node=0x82bc1e8, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:659
#8  0x0809ec8d in node_list_wrapper_dtor (node=0x82bc1e8, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:659
#9  0x0809ec8d in node_list_wrapper_dtor (node=0x82bc1e8, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:659
#10 0x0809ec8d in node_list_wrapper_dtor (node=0x82bc1e8, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:659
...
thousands more lines like the above.

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2006-03-18 11:47 UTC] rrichards@php.net 
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Sun Dec 22 01:01:30 2024 UTC