php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #29221 Segfault by using the DOM attribute ownerDocument in a PHP object
Submitted: 2004-07-17 10:23 UTC Modified: 2004-07-18 13:50 UTC
From: greg at zwiffer dot org Assigned:
Status: Closed Package: DOM XML related
PHP Version: 5.0.0 OS: Debian GNU/Linux (unstable)
Private report: No CVE-ID: None
 [2004-07-17 10:23 UTC] greg at zwiffer dot org
Description:
------------
PHP segfault when I use the DOM attribute ownerDocument in a PHP object. See the code for what happened.

I try with the command line : 
/opt/php5/bin/php -q my_file.php

I use a Debian GNU/Linux unstable with PHP 5.0.0, but I had also the problem with PHP 5.0.0RC3. Here is my version of libxml2 :

ii  libxml2        2.6.11-1       GNOME XML library
ii  libxml2-dev    2.6.11-1       Development files for the GNOME XML library

I compile PHP with the following configure line :
./compile --with-prefix=/opt/php5 --with-xsl --with-mysql

Thanks

Reproduce code:
---------------
<?php

class XMLReader {


	public $doc = NULL ;


	public function __construct($xml) {
		
		$dom = new DOMDocument() ;
		$dom->loadXML($xml) ;
		$this->doc = $dom->documentElement ;
		
	}
	
	
	public function owner() {
	
		return get_class($this->doc->ownerDocument) ;
		
	}
	
}

$dom = new DOMDocument() ;
$dom->loadXML('<test>This is a test</test>') ;
$docElt = $dom->documentElement ;
echo get_class($docElt->ownerDocument) ; // no segfault

$xml = new XMLReader('<test>This is a test</test>') ;
echo get_class($xml->doc->ownerDocument) ; //segfault

$xml = new XMLReader('<test>This is a test</test>') ;
echo get_class($xml->owner()) ; //segfault


?>


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2004-07-17 12:09 UTC] chregu@php.net
I can reproduce it (latest CVS HEAD).. Did shortly look 
at the source code, but I couldn't figure out, why it 
sefgaults. 

Something bad happens in

if ((intern = (dom_object *) 
php_dom_object_get_data((void *) obj))) {

in the function

zval *php_dom_create_object(xmlNodePtr obj, int *found, 
zval *wrapper_in, zval *return_value, dom_object *domobj 
TSRMLS_DC)

Maybe Rob looks into it later, or when I have more time 
;)

 [2004-07-17 12:12 UTC] chregu@php.net
I can reproduce it (latest CVS HEAD).. Did shortly look 
at the source code, but I couldn't figure out, why it 
sefgaults. 

Something bad happens in

if ((intern = (dom_object *) 
php_dom_object_get_data((void *) obj))) {

in the function

zval *php_dom_create_object(xmlNodePtr obj, int *found, 
zval *wrapper_in, zval *return_value, dom_object *domobj 
TSRMLS_DC)

Maybe Rob looks into it later, or when I have more time 
;)

 [2004-07-18 13:50 UTC] rrichards@php.net
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.


 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Mon May 13 23:01:33 2024 UTC