The following simple program crashes PHP4-CGI (presumably the PHP4 Apache module, too).




test.php
------------------------------------------------
<?php                                                                                    
if (!extension_loaded("domxml")) @dl("domxml.so");                                       
                                                                                         
$xml="test.xml";                                                                         
$object=domxml_open_file($xml);                                                          
$root=$object->document_element();                                                       
$nodes=$root->get_elements_by_tagname("module");                                         
                                                                                         
@reset($nodes);                                                                          
while($node=each($nodes)) {                                                              
        $cname=$node["value"]->get_attribute("class");                                   
        var_dump($cname);                                                                
}                                                                                        
?>

test.xml
-----------------
<?xml                                                                                    
        version="1.0"                                                                    
        encoding="ISO8859-2"                                                             
        standalone='yes'                                                                 
?>                                                                                       
<xpps>                                                                                   
        <module class="top">                                                             
                <id>2</id>                                                               
        </module>                                                                        
                                                                                         
        <module class="top2">                                                            
                <id>3</id>                                                               
        </module>                                                                        
                                                                                       </xpps>


gdb output:
-----------------
(gdb) set args test.php
(gdb) run
Starting program: /usr/bin/php4 test.php
X-Powered-By: PHP/4.2.1
Content-type: text/html

string(3) "top"
string(4) "top2"

Program received signal SIGSEGV, Segmentation fault.
0x402aad63 in free () from /lib/libc.so.6
(gdb) bt
#0  0x402aad63 in free () from /lib/libc.so.6
#1  0x402aaac3 in free () from /lib/libc.so.6
#2  0x080fbc94 in zend_hash_del_key_or_index (ht=0x8187d90, 
    arKey=0x400266d6 "domxml_open_mem", nKeyLength=16, h=2217637771, flag=0)
    at ../../Zend/zend_hash.c:517
#3  0x080fa1e0 in zend_unregister_functions (functions=0x40028c20, count=-1, 
    function_table=0x0) at ../../Zend/zend_API.c:1088
#4  0x080fa2b1 in module_destructor (module=0x81e1330) at ../../Zend/zend_API.c:1131
#5  0x080fc03d in zend_hash_apply_deleter (ht=0x8187cc0, p=0x81e1300)
    at ../../Zend/zend_hash.c:596
#6  0x080fc28c in zend_hash_apply (ht=0x8187cc0, 
    apply_func=0x80fa34c <module_registry_cleanup>) at ../../Zend/zend_hash.c:687
#7  0x080f7956 in zend_deactivate_modules () at ../../Zend/zend.c:581
#8  0x08065e99 in php_request_shutdown (dummy=0x0)
    at /mnt/jasmin/src2/php4-4.2.1/main/main.c:775
#9  0x08064414 in main (argc=2, argv=0xbffffac4)
    at /mnt/jasmin/src2/php4-4.2.1/sapi/cgi/cgi_main.c:827
#10 0x4025565f in __libc_start_main () from /lib/libc.so.6



--------

Some analysis:

In zend_API.c, the module_destructor(zend_module_entry *module) gets called on the end of the program, on module unload. The problem surfaces in clean_module_constants. The module is "domxml", so it seems that the DOM-XML module is broken, and somehow corrupts(?) the constants.