php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #24609 Finalization fails for freeing allocated XML objects because of invalid pointer
Submitted: 2003-07-11 13:18 UTC Modified: 2003-07-23 13:26 UTC
From: rehsack at liwing dot de Assigned:
Status: Closed Package: DOM XML related
PHP Version: 4.3.3RC1 OS: FreeBSD 5.1-CURRENT
Private report: No CVE-ID:
 [2003-07-11 13:18 UTC] rehsack at liwing dot de
Description:
------------
When a dom node is copied like below described wrong way, php fails when the method is executed at the end with:

Program received signal SIGBUS, Bus error.
xmlGetDtdAttrDesc (dtd=0xd0d0d0d0, elem=0x8aa4a70 "METATAG", name=0x8aa4a80 "NAME") at valid.c:2857
2857    valid.c: No such file or directory.
        in valid.c
(gdb) bt
#0  xmlGetDtdAttrDesc (dtd=0xd0d0d0d0, elem=0x8aa4a70 "METATAG", name=0x8aa4a80 "NAME") at valid.c:2857
#1  0x2867cc12 in xmlIsID (doc=0x8acb380, elem=0x8ace700, attr=0x8ace740) at valid.c:2315
#2  0x28668e84 in xmlFreeProp (cur=0x8ace740) at tree.c:1839
#3  0x28668dfb in xmlFreePropList (cur=0x0) at tree.c:1811
#4  0x2866a41a in xmlFreeNodeList (cur=0x8ace700) at tree.c:3108
#5  0x2866a3f7 in xmlFreeNodeList (cur=0x8ace5c0) at tree.c:3103
#6  0x2866a3f7 in xmlFreeNodeList (cur=0x8aa9f40) at tree.c:3103
#7  0x2866a3f7 in xmlFreeNodeList (cur=0x8aa9dc0) at tree.c:3103
#8  0x28667e35 in xmlFreeDoc (cur=0x8a8af80) at tree.c:1014
#9  0x0807be09 in php_free_xml_doc ()
#10 0x0816bc52 in list_entry_destructor ()
#11 0x0816b81c in zend_hash_apply_deleter ()
#12 0x0816a2cc in zend_hash_graceful_reverse_destroy ()
#13 0x0816be1f in zend_destroy_rsrc_list ()
#14 0x0815bb86 in shutdown_executor ()
#15 0x0816471e in zend_deactivate ()
#16 0x081359ef in php_request_shutdown ()
#17 0x0817b30d in main ()
#18 0x0806c285 in _start ()

Either the documentation of DomNode->replace_node() is wrong:
 (PHP 4.3) This function replaces an existing node with the passed new node. It is not copied anymore. If newnode was already inserted in the document it is first unlinked from its existing context
or the code of replace_node must be updated a little bit.

Reproduce code:
---------------
Wrong:

function ReplaceNodeWithFile( &$node, $filename )
{
$src = file( $filename );
$this->Dom = domxml_open_mem( $src );
$srcRoot = $src->document_element();
$node->replace_node( $srcRoot );
}

Right:
function ReplaceNodeWithFile( &$node, $filename )
{
$src = file( $filename );
$this->Dom = domxml_open_mem( $src );
$srcRoot = $src->document_element();
$cloned = $srcRoot->clone_node( TRUE );
$node->replace_node( $cloned );
}




Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2003-07-22 11:48 UTC] iliaa@php.net
Could you please supply the complete source (as small as possible) of the script resulting in the error as well as the XML file you are using/creating.
 [2003-07-23 13:26 UTC] iliaa@php.net
This bug has been fixed in CVS.

In case this was a PHP problem, snapshots of the sources are packaged
every three hours; this change will be in the next snapshot. You can
grab the snapshot at http://snaps.php.net/.
 
In case this was a documentation problem, the fix will show up soon at
http://www.php.net/manual/.

In case this was a PHP.net website problem, the change will show
up on the PHP.net site and on the mirror sites in short time.
 
Thank you for the report, and for helping us make PHP better.


 
PHP Copyright © 2001-2014 The PHP Group
All rights reserved.
Last updated: Sat Apr 19 04:01:55 2014 UTC