Bug #66783 [NEW]: Double free or corruption if appending DOMDocument to element
From: mfonda
Operating system: Linux
PHP version: Irrelevant
Package: DOM XML related
Bug Type: Bug
Bug description:Double free or corruption if appending DOMDocument to element
Description:
------------
Occurs when attempting to append a DOMDocument to a node within the
document.
Test script:
---------------
<?php
$dom = new DomDocument;
$dom->loadXML('<root></root>');
$e = $dom->createElement('e');
$e->appendChild($dom);
Actual result:
--------------
*** glibc detected *** php: double free or corruption (!prev):
0x0000000001bff0e0 ***
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x7eb96)[0x7fbb1bf08b96]
/usr/lib/x86_64-linux-gnu/libxml2.so.2(xmlFreeDoc+0x169)[0x7fbb1c29cbb9]
php(php_libxml_decrement_doc_ref+0x35)[0x4a0b35]
php(dom_objects_free_storage+0x2f)[0x4c3d9f]
php(zend_objects_store_del_ref_by_handle_ex+0x257)[0x7088a7]
php(zend_objects_store_del_ref+0x13)[0x7088c3]
php(_zval_ptr_dtor+0x58)[0x6cff08]
php[0x6ecaf5]
php(zend_hash_reverse_apply+0x71)[0x6ee601]
php(shutdown_destructors+0x61)[0x6d0211]
php(zend_call_destructors+0x37)[0x6dfd07]
php(php_request_shutdown+0x385)[0x67e4f5]
php[0x78cc42]
php(main+0x531)[0x464ad1]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xed)[0x7fbb1beab76d]
php[0x464b5d]
--
Edit bug report at https://bugs.php.net/bug.php?id=66783&edit=1
--
Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=66783&r=trysnapshot54
Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=66783&r=trysnapshot55
Try a snapshot (trunk): https://bugs.php.net/fix.php?id=66783&r=trysnapshottrunk
Fixed in SVN: https://bugs.php.net/fix.php?id=66783&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=66783&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=66783&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=66783&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=66783&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=66783&r=support
Expected behavior: https://bugs.php.net/fix.php?id=66783&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=66783&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=66783&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=66783&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=66783&r=php4
Daylight Savings: https://bugs.php.net/fix.php?id=66783&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=66783&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=66783&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=66783&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=66783&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=66783&r=mysqlcfg
Thread (6 messages)
- mfonda@php.net