Spoken too early, the bug is also present in 4.0.6, but the program doesn'crash, it says Maximum execution time exceeded ) and hangs.

Killing the process with SIGABRT produces the following backtrace (got from the core file)

(gdb) bt
#0  0x401b9d2b in chunk_free (ar_ptr=0x4026b520, p=0x81f9e10) at malloc.c:3252
#1  0x401b9ba8 in __libc_free (mem=0x81f9ee8) at malloc.c:3154
#2  0x080cd191 in _efree (ptr=0x81f9ef4) at zend_alloc.c:232
#3  0x080cd5bb in shutdown_memory_manager (silent=0, clean_cache=1) at zend_alloc.c:437
#4  0x08062fc4 in php_module_shutdown () at main.c:942
#5  0x08061e78 in main (argc=2, argv=0xbffff874) at cgi_main.c:752
#6  0x40159306 in __libc_start_main (main=0x8061664 <main>, argc=2, ubp_av=0xbffff874, init=0x805fe7c <_init>, fini=0x8105c60 <_fini>, 
    rtld_fini=0x4000d2dc <_dl_fini>, stack_end=0xbffff86c) at ../sysdeps/generic/libc-start.c:129

I have a testcase:

test.php:

<?
  @$data = implode("",file("export.xml"));
  $parser = xml_parser_create();
  xml_parser_set_option($parser,XML_OPTION_CASE_FOLDING,0);
  xml_parser_set_option($parser,XML_OPTION_SKIP_WHITE,1);
  xml_parse_into_struct($parser,$data,$values,$tags);
  xml_parser_free($parser);
  echo "OK!\n";
?>

The export.xml file is available on http://www.libertyline.com/download/export.xml.bz2 (the compressed version is only 3213 bytes)

I done some other tests with the latest snapshot (php4-20020206000).

If I put a set_time_limit(0) on the top of the script php doesn't crash but it takes a long time to finish (~3 minutes on an athlon XP1800 with 512M);  probably it is freeing memory a lot of memory.

If I put set_time_limit(10) the script crashes:


Starting program: /usr/local/bin/php test.php
OK!

Fatal error: Maximum execution time of 10 seconds exceeded in Unknown on line 0
Unknown(0) : Fatal error - Maximum execution time of 10 seconds exceeded

Program received signal SIGSEGV, Segmentation fault.
0x401b9e23 in chunk_free (ar_ptr=0x4026b520, p=0x8216dd0) at malloc.c:3228
3228	malloc.c: No such file or directory.
	in malloc.c
(gdb) bt
#0  0x401b9e23 in chunk_free (ar_ptr=0x4026b520, p=0x8216dd0) at malloc.c:3228
#1  0x401b9ba8 in __libc_free (mem=0x8217118) at malloc.c:3154
#2  0x08068e16 in shutdown_memory_manager (silent=1, clean_cache=0) at zend_alloc.c:524
#3  0x08083a32 in php_request_shutdown (dummy=0x0) at main.c:745
#4  0x08062b2e in main (argc=2, argv=0xbffff8a4) at php_cli.c:597
#5  0x40159306 in __libc_start_main (main=0x80623b4 <main>, argc=2, ubp_av=0xbffff8a4, init=0x8060a10 <_init>, fini=0x814ecf0 <_fini>, 
    rtld_fini=0x4000d2dc <_dl_fini>, stack_end=0xbffff89c) at ../sysdeps/generic/libc-start.c:129
(gdb) 

Thank you for taking the time to report a problem with PHP.
Unfortunately your are not using a current version of PHP -- 
the problem might already be fixed. Please download a new
PHP version from http://www.php.net/downloads.php

If you are able to reproduce the bug with one of the latest
versions of PHP, please change the PHP version on this bug report
to the version you tested and change the status back to "Open".
Again, thank you for your continued support of PHP.