php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #41833 addChild() on a non-existent node, no node created, getName() segfaults
Submitted: 2007-06-28 02:18 UTC Modified: 2007-07-31 15:42 UTC
From: hubert dot roksor at gmail dot com Assigned: rrichards
Status: Closed Package: SimpleXML related
PHP Version: 5CVS-2007-06-28 (snap) OS:
Private report: No CVE-ID:
 [2007-06-28 02:18 UTC] hubert dot roksor at gmail dot com
Description:
------------
addChild() does not behave as expected(?) when used on a node that wasn't previously declared.

In the example below, we initialize an empty tree, to which we attempt to add a new node at "/child/grandchild" without previously adding "child" to the tree. addChild() seems to operate on a temporary SimpleXMLElement and the changes are never applied to the original object/tree.

I believe that this bug is also responsible of the segfault that happens if getName() is used on the temporary SimpleXMLElement. I was very tempted to file this bug as a reproducible crash, but decided to file it under SimpleXML in case it would help routing it to the maintainer faster.


Tested on:

PHP 5.2.4-dev (cli) (built: Jun 27 2007 20:04:30)
WinXP
libxml2 2.6.26
SimpleXML Revision: 1.151.2.22.2.29

PHP 5.2.2-pl1-gentoo (cli) (built: May 24 2007 00:26:35)
libxml 2.6.27
SimpleXML Revision: 1.151.2.22.2.26

Reproduce code:
---------------
<?php

$xml = simplexml_load_string('<?xml version="1.0" encoding="utf-8" ?><root />');
$xml->child->addChild('grandchild');

echo $xml->asXML();

Expected result:
----------------
I expect SimpleXML to create "child" if it does not exist, then add "grandchild" to that node. The output should be:

<?xml version="1.0" encoding="utf-8"?>
<root><child><grandchild/></child></root>

Actual result:
--------------
Neither node is added to the tree. The output is:

<?xml version="1.0" encoding="utf-8"?>
<root/>

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2007-07-30 01:22 UTC] mail_ben_schmidt at yahoo dot com dot au
I believe related to this bug: on my machine (Mac OS X 10.4.9 Intel; PHP 5.2.3/5.2-200707181030) I get a bus error if I do it with a namespace, i.e.

$xml->child->addChild('grandchild','','whatever');

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_PROTECTION_FAILURE (0x0002) at 0x00000020

Thread 0 Crashed:
0   php 	0x0018596f zim_simplexml_element_addChild + 263 (simplexml.c:1512)
...

Ben.
 [2007-07-31 15:42 UTC] rrichards@php.net
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.

Segfaults are fixed. addChild() cannot be called on a temporary node, so output is correct and warning is now issued.
 
PHP Copyright © 2001-2014 The PHP Group
All rights reserved.
Last updated: Sat Apr 19 17:01:54 2014 UTC