Bug #69782 [NEW]: NULL pointer dereference

From: moltesalt at gmail dot com Operating system: PHP version: 5.6.9 Package: XSLT related Bug Type: Bug Bug description:NULL pointer dereference Description: ------------ The XSLTProcessor class missed a few checks on the input from the libxslt library. The valuePop() function call able to return with NULL pointer and php does not check that. These checks missed in xsltprocessor.c lines 304-305 and on lines 239-240 in the same function. http://lxr.php.net/xref/PHP_5_6/ext/xsl/xsltprocessor.c#305 All php versions affected, including trunk. Expected result: ---------------- $ php -f xpath.php Warning: XSLTProcessor::transformToXml(): xmlXPathCompOpEval: function d not found in xpath.php on line 31 Warning: XSLTProcessor::transformToXml(): Unregistered function in xpath.php on line 31 Warning: XSLTProcessor::transformToXml(): Stack usage errror in xpath.php on line 31 Actual result: -------------- $ php -f xpath.php Warning: XSLTProcessor::transformToXml(): xmlXPathCompOpEval: function d not found in xpath.php on line 31 Warning: XSLTProcessor::transformToXml(): Unregistered function in xpath.php on line 31 Warning: XSLTProcessor::transformToXml(): Stack usage errror in xpath.php on line 31 Segmentation fault -- Edit bug report at https://bugs.php.net/bug.php?id=69782&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=69782&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=69782&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=69782&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=69782&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=69782&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=69782&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=69782&r=needscript Try newer version: https://bugs.php.net/fix.php?id=69782&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=69782&r=support Expected behavior: https://bugs.php.net/fix.php?id=69782&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=69782&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=69782&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=69782&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=69782&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=69782&r=dst IIS Stability: https://bugs.php.net/fix.php?id=69782&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=69782&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=69782&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=69782&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=69782&r=mysqlcfg