Bug #18148: domxml module crashes PHP on module unload

From: php4bug@johnzero.hu Operating system: Linux PHP version: 4.2.1 PHP Bug Type: DOM XML related Bug description: domxml module crashes PHP on module unload The following simple program crashes PHP4-CGI (presumably the PHP4 Apache module, too). test.php ------------------------------------------------ <?php if (!extension_loaded("domxml")) @dl("domxml.so"); $xml="test.xml"; $object=domxml_open_file($xml); $root=$object->document_element(); $nodes=$root->get_elements_by_tagname("module"); @reset($nodes); while($node=each($nodes)) { $cname=$node["value"]->get_attribute("class"); var_dump($cname); } ?> test.xml ----------------- <?xml version="1.0" encoding="ISO8859-2" standalone='yes' ?> <xpps> <module class="top"> <id>2</id> </module> <module class="top2"> <id>3</id> </module> </xpps> gdb output: ----------------- (gdb) set args test.php (gdb) run Starting program: /usr/bin/php4 test.php X-Powered-By: PHP/4.2.1 Content-type: text/html string(3) "top" string(4) "top2" Program received signal SIGSEGV, Segmentation fault. 0x402aad63 in free () from /lib/libc.so.6 (gdb) bt #0 0x402aad63 in free () from /lib/libc.so.6 #1 0x402aaac3 in free () from /lib/libc.so.6 #2 0x080fbc94 in zend_hash_del_key_or_index (ht=0x8187d90, arKey=0x400266d6 "domxml_open_mem", nKeyLength=16, h=2217637771, flag=0) at ../../Zend/zend_hash.c:517 #3 0x080fa1e0 in zend_unregister_functions (functions=0x40028c20, count=-1, function_table=0x0) at ../../Zend/zend_API.c:1088 #4 0x080fa2b1 in module_destructor (module=0x81e1330) at ../../Zend/zend_API.c:1131 #5 0x080fc03d in zend_hash_apply_deleter (ht=0x8187cc0, p=0x81e1300) at ../../Zend/zend_hash.c:596 #6 0x080fc28c in zend_hash_apply (ht=0x8187cc0, apply_func=0x80fa34c <module_registry_cleanup>) at ../../Zend/zend_hash.c:687 #7 0x080f7956 in zend_deactivate_modules () at ../../Zend/zend.c:581 #8 0x08065e99 in php_request_shutdown (dummy=0x0) at /mnt/jasmin/src2/php4-4.2.1/main/main.c:775 #9 0x08064414 in main (argc=2, argv=0xbffffac4) at /mnt/jasmin/src2/php4-4.2.1/sapi/cgi/cgi_main.c:827 #10 0x4025565f in __libc_start_main () from /lib/libc.so.6 -------- Some analysis: In zend_API.c, the module_destructor(zend_module_entry *module) gets called on the end of the program, on module unload. The problem surfaces in clean_module_constants. The module is "domxml", so it seems that the DOM-XML module is broken, and somehow corrupts(?) the constants. -- Edit bug report at http://bugs.php.net/?id=18148&edit=1 -- Fixed in CVS: http://bugs.php.net/fix.php?id=18148&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=18148&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=18148&r=needtrace Try newer version: http://bugs.php.net/fix.php?id=18148&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=18148&r=support Expected behavior: http://bugs.php.net/fix.php?id=18148&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=18148&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=18148&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=18148&r=globals