Bug #69288 [Opn->Csd]: Regression introduced in fix for bug 69085 leads to segmentation fault

From: Date: Wed, 25 Mar 2015 05:38:44 +0000
Subject: Bug #69288 [Opn->Csd]: Regression introduced in fix for bug 69085 leads to segmentation fault
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-191589@lists.php.net to get a copy of this message 
Edit report at https://bugs.php.net/bug.php?id=69288&edit=1

 ID:                 69288
 Updated by:         laruence@php.net
 Reported by:        thomas at shadowweb dot org
 Summary:            Regression introduced in fix for bug 69085 leads to
                     segmentation fault
-Status:             Open
+Status:             Closed
 Type:               Bug
 Package:            Reproducible crash
 PHP Version:        5.4.39
-Assigned To:        
+Assigned To:        laruence
 Block user comment: N
 Private report:     N

 New Comment:

oh....... I just committed a same fix for #69293, didn't see your report and patch :<

anyway, thanks for the reporting and fix


Previous Comments:
------------------------------------------------------------------------
[2015-03-24 14:24:06] thomas at shadowweb dot org

Description:
------------
A bug/regression introduced in commit c8eaca013a3922e8383def6158ece2b63f6ec483 (for PHP 5.4) and
b3ac3522534a75edb76312cf9a576e4624372123 (Merge to PHP 5.5) leads to reproductible segmentation
faults, when using SOAP with PHP versions 5.4.39 and 5.5.23.

I will not include a testscript, since the bug is obvious from the commit:

-               if (zend_hash_find(ht, "enc_namens", sizeof("enc_namens"), (void
**)&znamens) == SUCCESS) {
+               if (zend_hash_find(ht, "enc_namens", sizeof("enc_namens"), (void
**)&znamens) == SUCCESS &&
+                   Z_TYPE_PP(zname) == IS_STRING) {
                        xmlNsPtr nsp = encode_add_ns(node, Z_STRVAL_PP(znamens));
                        xmlSetNs(node, nsp);
                }


"Z_TYPE_PP(zname) == IS_STRING" should be "Z_TYPE_PP(znamens)", the included
patch is for PHP 5.4.39.



------------------------------------------------------------------------



--
Edit this bug report at https://bugs.php.net/bug.php?id=69288&edit=1

Thread (4 messages)

« previous php.bugs (#191589) next »