php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #79968 DOMText::before() crashes
Submitted: 2020-08-13 11:06 UTC Modified: 2020-08-13 11:06 UTC
From: nikic@php.net Assigned: beberlei (profile)
Status: Closed Package: DOM XML related
PHP Version: 8.0.0beta1 OS:
Private report: No CVE-ID: None
View Developer Edit
 [2020-08-13 11:06 UTC] nikic@php.net 
Description:
------------
<?php
$cdata = new DOMText;
$cdata->before(null);

==441255== Invalid read of size 4
==441255==    at 0x488E30: dom_zvals_to_fragment (parentnode.c:137)
==441255==    by 0x489514: dom_parent_node_before (parentnode.c:339)
==441255==    by 0x494744: zim_DOMCharacterData_before (characterdata.c:428)
==441255==    by 0x9FA8B4: ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER (zend_vm_execute.h:1618)
==441255==    by 0xA678B8: execute_ex (zend_vm_execute.h:53562)
==441255==    by 0xA6CA21: zend_execute (zend_vm_execute.h:57766)
==441255==    by 0x9C134B: zend_execute_scripts (zend.c:1696)
==441255==    by 0x923E4E: php_execute_script (main.c:2535)
==441255==    by 0xAABE2F: do_cli (php_cli.c:949)
==441255==    by 0xAACE6E: main (php_cli.c:1336)
==441255==  Address 0x8 is not stack'd, malloc'd or (recently) free'd

Patches

Pull Requests

Pull requests:

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2020-08-13 11:06 UTC] nikic@php.net
-Assigned To: +Assigned To: beberlei
 [2020-08-15 08:38 UTC] beberlei@php.net 
According to the spec, for an element that has its hierachy preconditions fail an exception should be thrown:

node . before(...nodes)

    Inserts nodes just before node, while replacing strings in nodes with equivalent Text nodes.

    Throws a "HierarchyRequestError" DOMException if the constraints of the node tree are violated.

It looks this is not implemented and causes the segfault.
 [2020-08-15 08:54 UTC] beberlei@php.net 
The following pull request has been associated:

Patch Name: Fix #79968: Manipulation on unattached DOMChildNode should throw DOMException
On GitHub:  https://github.com/php/php-src/pull/5990
Patch:      https://github.com/php/php-src/pull/5990.patch
 [2020-08-19 09:55 UTC] beberlei@php.net 
Automatic comment on behalf of kontakt@beberlei.de
Revision: http://git.php.net/?p=php-src.git;a=commit;h=9f6820f7f1bfde876cb91bfd473f6d8b679fc474
Log: Fix #79968: Manipulation on unattached DOMChildNode should throw DOMException
 [2020-08-19 09:55 UTC] beberlei@php.net
-Status: Assigned +Status: Closed
 [2020-08-19 10:20 UTC] beberlei@php.net 
Automatic comment on behalf of kontakt@beberlei.de
Revision: http://git.php.net/?p=php-src.git;a=commit;h=a34fd4d590b36a9c42bb7e65c51202ef951afbdf
Log: Update NEWS w.r.t to bugfix #79968
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Fri Oct 31 07:00:01 2025 UTC