#41702 [NEW]: php5 crashes when issuing an XPath query that incorrectly uses the XPath contai

From: wendell at bani dot com dot br Operating system: Linux Ubuntu Feisty PHP version: 5.2.3 PHP Bug Type: DOM XML related Bug description: php5 crashes when issuing an XPath query that incorrectly uses the XPath contai Description: ------------ Bug reported in Ubuntu (http://launchpad.net/bugs/103027): See the attached PHP script for an example that will crash PHP. This could be (is likely to be?) a bug in libxml2, but I'm not one to make that call. Reproduce code: --------------- <?php $dom = new DomDocument(); $dom->loadHTML( "<html> <table> <tr><td>Cancellation of blabla</td></tr> </table> <table> <tr><td>second table</td></tr> </table> <table> <tr><td>third table</td></tr> </table> </html>"); $xp = new DomXPath($dom); $matches = $xp->query("//table[contains('second')]"); ?> Actual result: -------------- 0 0xb7aaba16 in malloc_consolidate () from /lib/tls/i686/cmov/libc.so.6 #1 0xb7aade38 in _int_malloc () from /lib/tls/i686/cmov/libc.so.6 #2 0xb7aaeef5 in _int_realloc () from /lib/tls/i686/cmov/libc.so.6 #3 0xb7ab108e in realloc () from /lib/tls/i686/cmov/libc.so.6 #4 0xb7bf7dba in ?? () from /usr/lib/libxml2.so.2 #5 0x086dee70 in ?? () #6 0x00000370 in ?? () #7 0xbff075e8 in ?? () #8 0xb7bf58ec in ?? () from /usr/lib/libxml2.so.2 #9 0x00000000 in ?? () -- Edit bug report at http://bugs.php.net/?id=41702&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=41702&r=trysnapshot44 Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=41702&r=trysnapshot52 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=41702&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=41702&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=41702&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=41702&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=41702&r=needscript Try newer version: http://bugs.php.net/fix.php?id=41702&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=41702&r=support Expected behavior: http://bugs.php.net/fix.php?id=41702&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=41702&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=41702&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=41702&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=41702&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=41702&r=dst IIS Stability: http://bugs.php.net/fix.php?id=41702&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=41702&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=41702&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=41702&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=41702&r=mysqlcfg