#42728 [Opn->Fbk]: tidy_get_body segfaults on bad page

ID: 42728 Updated by: scottmac@php.net Reported By: nyos at nyos dot homelinux dot net -Status: Open +Status: Feedback Bug Type: Reproducible crash Operating System: Kubuntu linux 7.04 Feisty Fawn PHP Version: 5.2.4 New Comment: Thank you for this bug report. To properly diagnose the problem, we need a backtrace to see what is happening behind the scenes. To find out how to generate a backtrace, please read http://bugs.php.net/bugs-generating-backtrace.php for *NIX and http://bugs.php.net/bugs-generating-backtrace-win32.php for Win32 Once you have generated a backtrace, please submit it to this bug report and change the status back to "Open". Thank you for helping us make PHP better. Previous Comments: ------------------------------------------------------------------------ [2007-09-21 14:50:38] nyos at nyos dot homelinux dot net Description: ------------ Tidy (libtidy, php-tidy) fails on a (syntactically) incorrect page. This mustn't happen of course. A segmentation fault might be caused by a buffer overrun, or a wandering pointer, which might be a security issue as well. (However, breaking into a bot using tidy through this bug is very unlikely.) Tidy's purpose is to correct incorrect pages, so it needs to be error-proof. versions: ubuntu feisty default install + kubuntu-desktop + up-to date system, however, I'm not sure even if it's a bug in php or in tidy Package: tidy Version: 20051018-1 Package: libtidy-0.99-0 Version: 20051018-1 Package: php5-tidy Version: 5.2.1-0ubuntu1.4 (this is the newest version in package, but I didn't see anything about this bug, so possibly it's still a bug) Reproduce code: --------------- <? /* // this won't work either $file_data=' <html> <frameset > </frameset> </html> '; */ $file_data=' <frameset > </frameset> '; $t=tidy_parse_string(trim($file_data)); $t->cleanRepair(); echo "following line segfaults..\n"; $body=tidy_get_body($t); echo "..or works?\n"; ?> Expected result: ---------------- $body=null, warning, or anything else.. Actual result: -------------- nyos@falken:~/webmasters/tidybug$ ./tidy.php following line segfaults.. Segmentation fault (core dumped) ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=42728&edit=1