|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #31033 RegisterPhpFunctions: php:function(string, nodeset) with xsl:key crush PHP
Submitted: 2004-12-09 06:21 UTC Modified: 2005-03-02 19:32 UTC
From: 4mirror at mail dot ru Assigned:
Status: Closed Package: XSLT related
PHP Version: 5.0.2 OS: Windows 2000 sp4
Private report: No CVE-ID:
 [2004-12-09 06:21 UTC] 4mirror at mail dot ru
If we have 
<xsl:key name="bar" match="foo" use="@baz"/>
anywere in stylesheet, any call of 
crush php.

In result, Apache return 500 (and Windows say: "Unhandled exception at 0x10189120 in php-cgi.exe: 0xC0000005: 
Access violation reading location 0x31223d72"), or never return anything, or PHP return many false errors.

PHP - release 5.0.2, win32 binary distribution.
Configure Command (from PHPinfo): cscript /nologo configure.js "--enable-snapshot-build" "--with-gd=shared"
Server API: CGI/FastCGI

Apache - 1.3.27 (Win32)
libxml2 - 2.6.11, libxslt - 1.1.7, libexslt - 0.8.5

P.S. We can see "Expected result" after we delete string  with mark <!-- !!! --> in "Reproduce code"...

Reproduce code:
function myCrach($xml) { return $xml[0]->nodeName; }
<xsl:stylesheet version="1.0" xmlns:php="" xmlns:xsl="">
 <xsl:key name="data" match="tag" use="@bar"/> <!-- !!! -->
 <xsl:template match="tag">
  <xsl:value-of select="php:function('myCrach',..)"/> 
$domxml=DomDocument::loadXML('<test><tag bar="foo">baz</tag> </test>');
$xsl=new xsltProcessor();
echo $xsl->transformtoXML($domxml);

Expected result:

Actual result:
server no response, php going to infinite cycle...


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2005-02-28 21:18 UTC]
Please try using this CVS snapshot:
For Windows:

 [2005-03-02 19:32 UTC]
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
Thank you for the report, and for helping us make PHP better.

Fixed for 5.1
PHP Copyright © 2001-2015 The PHP Group
All rights reserved.
Last updated: Sat Nov 28 02:01:31 2015 UTC