php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #27467 domDocument::load() called from class method crashes
Submitted: 2004-03-02 14:48 UTC Modified: 2004-03-03 15:52 UTC
Votes:2
Avg. Score:4.5 ± 0.5
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:0 (0.0%)
From: ds at cyberspace dot co dot za Assigned: rrichards (profile)
Status: Closed Package: DOM XML related
PHP Version: 5CVS-2004-03-02 (dev) OS: WinXP
Private report: No CVE-ID: None
 [2004-03-02 14:48 UTC] ds at cyberspace dot co dot za
Description:
------------
Calling domDocument::load() from within a class method PHP crashes.

Reproduce code:
---------------
<?php

class docLoader {
  public function __construct($xslFile) {
    $xsltDoc = domDocument::load($xslFile);
  }
}

$doc = new docLoader('file.xsl'); // does not work

// however

$xsltDoc = domDocument::load('file.xsl'); // still works

?>

Expected result:
----------------
Should return object

Actual result:
--------------
Both PHP CLI and Apache module crash.  Only when domDocument::load() is called from a class method.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2004-03-02 14:59 UTC] derick@php.net
Verified on Linux, backtrace follows. Also assigned to Rob (looks like a double free to me somewhere).

0x0808af07 in dom_get_doc_props (document=0x845a5a5a)
    at /dat/dev/php/php-5.0dev/ext/dom/php_dom.c:119
119             if (document && document->doc_props) {
(gdb) bt
#0  0x0808af07 in dom_get_doc_props (document=0x845a5a5a)
    at /dat/dev/php/php-5.0dev/ext/dom/php_dom.c:119
#1  0x08092e96 in dom_document_parser (id=0x40562b08, mode=1,
    source=0x40560470 "file.xsl")
    at /dat/dev/php/php-5.0dev/ext/dom/document.c:1390
#2  0x0809319e in dom_parse_document (ht=1, return_value=0x4056057c,
    this_ptr=0x40562b08, return_value_used=1, mode=1)
    at /dat/dev/php/php-5.0dev/ext/dom/document.c:1497
#3  0x08093312 in zif_domdocument_load (ht=1, return_value=0x4056057c,
    this_ptr=0x40562b08, return_value_used=1)
    at /dat/dev/php/php-5.0dev/ext/dom/document.c:1536
#4  0x082ab827 in execute_internal (execute_data_ptr=0xbfffd300,
    return_value_used=1) at /dat/dev/php/php-5.0dev/Zend/zend_execute.c:1290
#5  0x4075afa3 in xdebug_execute_internal (current_execute_data=0xbfffd300,
    return_value_used=1) at /dat/dev/php/xdebug/xdebug.c:895
#6  0x082af124 in zend_do_fcall_common_helper (execute_data=0xbfffd300,
    opline=0x40561774, op_array=0x40562860)
    at /dat/dev/php/php-5.0dev/Zend/zend_execute.c:2650
#7  0x082af708 in zend_do_fcall_by_name_handler (execute_data=0xbfffd300,
    opline=0x40561774, op_array=0x40562860)
    at /dat/dev/php/php-5.0dev/Zend/zend_execute.c:2759
#8  0x082ab956 in execute (op_array=0x40562860)
    at /dat/dev/php/php-5.0dev/Zend/zend_execute.c:1339
---Type <return> to continue, or q <return> to quit---
#9  0x4075ae5a in xdebug_execute (op_array=0x40562860)
    at /dat/dev/php/xdebug/xdebug.c:863
#10 0x082af287 in zend_do_fcall_common_helper (execute_data=0xbfffd550,
    opline=0x4055ff34, op_array=0x4055fa9c)
    at /dat/dev/php/php-5.0dev/Zend/zend_execute.c:2677
#11 0x082af708 in zend_do_fcall_by_name_handler (execute_data=0xbfffd550,
    opline=0x4055ff34, op_array=0x4055fa9c)
    at /dat/dev/php/php-5.0dev/Zend/zend_execute.c:2759
#12 0x082ab956 in execute (op_array=0x4055fa9c)
    at /dat/dev/php/php-5.0dev/Zend/zend_execute.c:1339
#13 0x4075ae5a in xdebug_execute (op_array=0x4055fa9c)
    at /dat/dev/php/xdebug/xdebug.c:863
#14 0x08288e9b in zend_execute_scripts (type=8, retval=0x0, file_count=3)
    at /dat/dev/php/php-5.0dev/Zend/zend.c:1041
#15 0x08244940 in php_execute_script (primary_file=0xbffff9e0)
    at /dat/dev/php/php-5.0dev/main/main.c:1650
#16 0x082b816d in main (argc=1, argv=0xbffffa74)
    at /dat/dev/php/php-5.0dev/sapi/cli/php_cli.c:941
(gdb)


 [2004-03-03 15:52 UTC] rrichards@php.net
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.


 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sat Apr 20 13:01:29 2024 UTC