|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #37981 XML parser crashes
Submitted: 2006-07-01 13:46 UTC Modified: 2006-07-19 14:02 UTC
From: Assigned:
Status: Not a bug Package: *XML functions
PHP Version: 4CVS-2006-07-01 (CVS) OS: Linux
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If this is not your bug, you can add a comment by following this link.
If this is your bug, but you forgot your password, you can retrieve your password here.
Bug Type:
New email:
PHP Version: OS:


 [2006-07-01 13:46 UTC]
Running this script produces:
*** glibc detected *** corrupted double-linked list: 0x08460128 ***

zend memory manager is disabled:
PHP API => 20041225
PHP Extension => 20050922
Zend Extension => 220060519
Debug Build => yes
Thread Safety => disabled
Zend Memory Manager => disabled
IPv6 Support => enabled
Registered PHP Streams => php, file, data, http, ftp, compress.bzip2, compress.zlib
Registered Stream Socket Transports => tcp, udp, unix, udg
Registered Stream Filters => string.rot13, string.toupper, string.tolower, string.strip_tags, convert.*, consumed, convert.iconv.*, bzip2.*, zlib.*

Reproduce code:

class test {

    function test() {
        // initialize parser
        $this->parser = xml_parser_create();
        xml_set_element_handler( $this->parser,
                                 array( & $this, "startTag" ),
                                 array( & $this, "endTag" )


$parser = new test();


Actual result:

Program received signal SIGABRT, Aborted.
[Switching to Thread -1216296736 (LWP 21580)]
0xb78fd7c7 in raise () from /lib/tls/
(gdb) bt
#0  0xb78fd7c7 in raise () from /lib/tls/
#1  0xb78ff06b in abort () from /lib/tls/
#2  0xb7934545 in __fsetlocking () from /lib/tls/
#3  0xb793acbc in malloc_usable_size () from /lib/tls/
#4  0xb793b032 in free () from /lib/tls/
#5  0x081a1a6f in poolDestroy (pool=0x84613f8)
    at /dat/dev/php/php-4.4dev/ext/xml/expat/xmlparse.c:5419
#6  0x081983f9 in php_XML_ParserFree (parser=0x8461268)
    at /dat/dev/php/php-4.4dev/ext/xml/expat/xmlparse.c:1055
#7  0x08193d8d in xml_parser_dtor (rsrc=0x8460d78)
    at /dat/dev/php/php-4.4dev/ext/xml/xml.c:297
#8  0x081fc2c6 in list_entry_destructor (ptr=0x8460d78)
    at /dat/dev/php/php-4.4dev/Zend/zend_list.c:177
#9  0x081fa433 in zend_hash_del_key_or_index (ht=0x83fa468, arKey=0x0,
    nKeyLength=0, h=4, flag=1) at /dat/dev/php/php-4.4dev/Zend/zend_hash.c:527
#10 0x081fc02d in _zend_list_delete (id=4)
    at /dat/dev/php/php-4.4dev/Zend/zend_list.c:56
#11 0x081f42db in _zval_dtor (zvalue=0x8460d98,
    __zend_filename=0x838ef2c "/dat/dev/php/php-4.4dev/Zend/zend_execute_API.c", __zend_lineno=289) at /dat/dev/php/php-4.4dev/Zend/zend_variables.c:69
#12 0x081ebb2f in _zval_ptr_dtor (zval_ptr=0x8460d04,
    __zend_filename=0x838f748 "/dat/dev/php/php-4.4dev/Zend/zend_variables.c",
    __zend_lineno=171) at /dat/dev/php/php-4.4dev/Zend/zend_execute_API.c:289
#13 0x081f4524 in _zval_ptr_dtor_wrapper (zval_ptr=0x8460d04)
    at /dat/dev/php/php-4.4dev/Zend/zend_variables.c:171
#14 0x081fa50a in zend_hash_destroy (ht=0x8460d48)
    at /dat/dev/php/php-4.4dev/Zend/zend_hash.c:556
#15 0x081f42b6 in _zval_dtor (zvalue=0x8460d38,
    __zend_filename=0x838ef2c "/dat/dev/php/php-4.4dev/Zend/zend_execute_API.c", __zend_lineno=289) at /dat/dev/php/php-4.4dev/Zend/zend_variables.c:60
#16 0x081ebb2f in _zval_ptr_dtor (zval_ptr=0x8461ab4,
    __zend_filename=0x838f748 "/dat/dev/php/php-4.4dev/Zend/zend_variables.c",
    __zend_lineno=171) at /dat/dev/php/php-4.4dev/Zend/zend_execute_API.c:289
#17 0x081f4524 in _zval_ptr_dtor_wrapper (zval_ptr=0x8461ab4)
    at /dat/dev/php/php-4.4dev/Zend/zend_variables.c:171
#18 0x081fa50a in zend_hash_destroy (ht=0x8461a50)
    at /dat/dev/php/php-4.4dev/Zend/zend_hash.c:556
#19 0x081f4284 in _zval_dtor (zvalue=0x8461b18,
    __zend_filename=0x838ef2c "/dat/dev/php/php-4.4dev/Zend/zend_execute_API.c", __zend_lineno=289) at /dat/dev/php/php-4.4dev/Zend/zend_variables.c:51
#20 0x081ebb2f in _zval_ptr_dtor (zval_ptr=0x8459554,
    __zend_filename=0x8370e70 "/dat/dev/php/php-4.4dev/ext/xml/xml.c",
    __zend_lineno=309) at /dat/dev/php/php-4.4dev/Zend/zend_execute_API.c:289
#21 0x08193e2b in xml_parser_dtor (rsrc=0x8460d78)
---Type <return> to continue, or q <return> to quit---q
 at /dat/dev/php/php-4.4dev/exQuit



Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2006-07-19 14:02 UTC]
Please do not submit the same bug more than once. An existing
bug report already describes this very problem. Even if you feel
that your issue is somewhat different, the resolution is likely
to be the same. 

Thank you for your interest in PHP.

See bug #32494
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sun Jul 14 07:01:29 2024 UTC