#47287 [NEW]: Accessing non existant body element cause segfault

From: msiekkinen at gmail dot com Operating system: CentOS 5.2 PHP version: 5.2CVS-2009-02-03 (snap) PHP Bug Type: Reproducible crash Bug description: Accessing non existant body element cause segfault Description: ------------ OS Linux myserver 2.6.18-92.1.22.el5 #1 SMP Tue Dec 16 11:57:43 EST 2008 x86_64 x86_64 x86_64 GNU/Linux CentOS release 5.2 (Final) PHP PHP 5.2.4 (cli) (built: Nov 14 2008 11:28:15) Copyright (c) 1997-2007 The PHP Group Zend Engine v2.2.0, Copyright (c) 1998-2007 Zend Technologies Tidy Tidy support => enabled libTidy Release => 18 March 2008 Extension Version => 2.0 ($Id: tidy.c,v 1.66.2.8.2.23 2007/05/04 17:11:05 nlopess Exp $) Calling tidy's body() method when none is present results in a segfault Reproduce code: --------------- $text='<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Frameset//EN"> <html> <head><title>Assistant (Legal issues) m/w</title> </head> <frameset name="frameset" framespacing="0" border="false"frameborder="0" rows="41,*,25"> <noframes> </noframes> <frame scrolling=no name="oben" src="/viewjob_header.php?jid=45482"> <frame scrolling=auto name="anzeige" src="/viewjob_main.php?jid=45482"> <frame scrolling=no name="unten" src="/viewjob_footer.php?jid=45482"> </frameset>'; $tidy = new tidy(); $tidyConfig=array('char-encoding'=>'utf8','input-encoding'=>'utf8','output- bom'=>'false','output-encoding'=>'utf8'); $tidy->parseString(file_get_contents('wtf.html'),$tidyConfig,'utf8'); print "Parsed it at least\n"; $tidy->CleanRepair(); print "Repaired\n"; $body = $tidy->body(); print "This message will not see the light of day"; var_dump($body); Expected result: ---------------- I would expect it to run through and output *something* in the var_dump(), but it segfaults before it can get that far. Actual result: -------------- #0 0x00cd86aa in tidyGetChild () from /usr/local/lib/libtidy-0.99.so.0 #1 0x082d8495 in tidy_add_default_properties (obj=0xb7439358, type=is_node) at /usr/local/src/php-5.2.4/ext/tidy/tidy.c:811 #2 0x082d88ee in php_tidy_create_node (ht=0, return_value=0xb67a947c, return_value_ptr=0x0, this_ptr=0xb692c690, return_value_used=1, node=is_body_node) at /usr/local/src/php-5.2.4/ext/tidy/tidy.c:902 #3 0x082dad5d in zif_tidy_get_body (ht=0, return_value=0xb67a947c, return_value_ptr=0x0, this_ptr=0xb692c690, return_value_used=1) at /usr/local/src/php-5.2.4/ext/tidy/tidy.c:1548 #4 0x08358d8f in zend_do_fcall_common_helper_SPEC (execute_data=0xbfef4af0) at /usr/local/src/php-5.2.4/Zend/zend_vm_execute.h:200 #5 0x083597a5 in ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER (execute_data=0xbfef4af0) at /usr/local/src/php-5.2.4/Zend/zend_vm_execute.h:322 #6 0x083589a4 in execute (op_array=0xb7f42bc4) at /usr/local/src/php-5.2.4/Zend/zend_vm_execute.h:92 #7 0x083393c2 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /usr/local/src/php-5.2.4/Zend/zend.c:1134 #8 0x082f2bfd in php_execute_script (primary_file=0xbfef6eb0) at /usr/local/src/php-5.2.4/main/main.c:1982 #9 0x0839f299 in main (argc=2, argv=0xbfef6f84) at /usr/local/src/php-5.2.4/sapi/cli/php_cli.c:1140 -- Edit bug report at http://bugs.php.net/?id=47287&edit=1 -- Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=47287&r=trysnapshot52 Try a CVS snapshot (PHP 5.3): http://bugs.php.net/fix.php?id=47287&r=trysnapshot53 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=47287&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=47287&r=fixedcvs Fixed in CVS and need be documented: http://bugs.php.net/fix.php?id=47287&r=needdocs Fixed in release: http://bugs.php.net/fix.php?id=47287&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=47287&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=47287&r=needscript Try newer version: http://bugs.php.net/fix.php?id=47287&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=47287&r=support Expected behavior: http://bugs.php.net/fix.php?id=47287&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=47287&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=47287&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=47287&r=globals PHP 4 support discontinued: http://bugs.php.net/fix.php?id=47287&r=php4 Daylight Savings: http://bugs.php.net/fix.php?id=47287&r=dst IIS Stability: http://bugs.php.net/fix.php?id=47287&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=47287&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=47287&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=47287&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=47287&r=mysqlcfg