|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #29409 PHP segfaults when domDocument::documentElement return as variable
Submitted: 2004-07-27 17:07 UTC Modified: 2004-07-28 14:44 UTC
From: Assigned:
Status: Closed Package: XSLT related
PHP Version: 5.0.0 OS: WinXP w/SP1
Private report: No CVE-ID:
 [2004-07-27 17:07 UTC]
When you assign a the DomDocument::documentElement to a variable before returning it from a function called by the XSL extension, PHP segfaults.

See code for better explanation.

- Davey

Reproduce code:
$xsl = <<<XSL
<?xml version="1.0" encoding="UTF-8"?>
<xsl:stylesheet version="1.0" xmlns:php="" xmlns:xsl="" xmlns:crtx="">
	<xsl:output method="xml" version="1.0" encoding="UTF-8" indent="yes" omit-xml-declaration="yes" />
	<xsl:strip-space elements="*"/>
	<xsl:template match="/">
        <xsl:copy-of select="php:function('returnDomElement')" />
$xml = <<<XML
function returnDomElement() {
    $xml = '<root><child>cdata</child></root>';
    $dom = domDocument::loadXML($xml);
    /* change to 'return $dom->documentElement' and it works */
    $return = $dom->documentElement;
    return $return
$xsl = domDocument::loadXML($xsl);
$xml = domDocument::loadXML($xml);
$xp = new xsltProcessor;
echo $xp->transformToXML($xml);

Expected result:

Actual result:
</> in the output and a segfault (details will be added by chregu)


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2004-07-28 09:12 UTC]
Fix is on the way
 [2004-07-28 14:44 UTC]
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
Thank you for the report, and for helping us make PHP better.

PHP Copyright © 2001-2015 The PHP Group
All rights reserved.
Last updated: Thu Oct 08 16:01:42 2015 UTC