From: rainer-phpbugs at 7val dot com
Operating system:
PHP version: 7.0.0RC1
Package: DOM XML related
Bug Type: Bug
Bug description:print_r() on DOMAttr causes Segfault in php_libxml_node_free_list()
Description:
------------
(gdb) run a.php
Starting program: /home/canavan/FIT/14-7/lib/fit/bin/php a.php
[Thread debugging using libthread_db enabled]
Using host libthread_db library
"/lib/x86_64-linux-gnu/libthread_db.so.1".
Program received signal SIGSEGV, Segmentation fault.
php_libxml_node_free_list (node=0x21) at
/home/canavan/fit/trunk/build/src/external/php-7.0.0RC1/ext/libxml/libxml.c:235
235 switch (node->type) {
(gdb) bt
#0 php_libxml_node_free_list (node=0x21) at
/home/canavan/fit/trunk/build/src/external/php-7.0.0RC1/ext/libxml/libxml.c:235
#1 0x000000000045c769 in php_libxml_node_free_list (node=0xe4ca90) at
/home/canavan/fit/trunk/build/src/external/php-7.0.0RC1/ext/libxml/libxml.c:255
#2 0x000000000045c8c1 in php_libxml_node_free_resource (node=0x21) at
/home/canavan/fit/trunk/build/src/external/php-7.0.0RC1/ext/libxml/libxml.c:1298
#3 0x000000000045ca78 in php_libxml_node_decrement_resource
(object=0x21) at
/home/canavan/fit/trunk/build/src/external/php-7.0.0RC1/ext/libxml/libxml.c:1333
#4 0x0000000000473005 in dom_objects_free_storage
(object=0x7ffff1270198) at
/home/canavan/fit/trunk/build/src/external/php-7.0.0RC1/ext/dom/php_dom.c:1045
#5 0x000000000071d61a in zend_objects_store_del (object=0x7ffff1270198)
at
/home/canavan/fit/trunk/build/src/external/php-7.0.0RC1/Zend/zend_objects_API.c:181
#6 0x0000000000472d15 in _zval_dtor (zvalue=0x7fffffff9f50,
zvalue=0x7fffffff9f50) at
/home/canavan/fit/trunk/build/src/external/php-7.0.0RC1/Zend/zend_variables.h:43
#7 dom_get_debug_info_helper (is_temp=<optimized out>,
object=<optimized out>) at
/home/canavan/fit/trunk/build/src/external/php-7.0.0RC1/ext/dom/php_dom.c:444
#8 dom_get_debug_info (object=<optimized out>, is_temp=<optimized out>)
at
/home/canavan/fit/trunk/build/src/external/php-7.0.0RC1/ext/dom/php_dom.c:459
#9 0x00000000006d9c09 in zend_print_zval_r_ex (write_func=0x66c070
<php_output_wrapper>, expr=0x7ffff12131c0, indent=indent@entry=0)
at
/home/canavan/fit/trunk/build/src/external/php-7.0.0RC1/Zend/zend.c:359
#10 0x00000000006d9d74 in zend_print_zval_r (expr=<optimized out>,
indent=indent@entry=0) at
/home/canavan/fit/trunk/build/src/external/php-7.0.0RC1/Zend/zend.c:324
#11 0x00000000005e252e in zif_print_r (execute_data=<optimized out>,
return_value=0x7ffff1213150)
at
/home/canavan/fit/trunk/build/src/external/php-7.0.0RC1/ext/standard/basic_functions.c:5488
#12 0x000000000073379d in ZEND_DO_ICALL_SPEC_HANDLER () at
/home/canavan/fit/trunk/build/src/external/php-7.0.0RC1/Zend/zend_vm_execute.h:577
#13 0x0000000000722fcb in execute_ex (ex=<optimized out>) at
/home/canavan/fit/trunk/build/src/external/php-7.0.0RC1/Zend/zend_vm_execute.h:406
#14 0x0000000000790547 in zend_execute (op_array=0x7ffff1284000,
return_value=<optimized out>)
at
/home/canavan/fit/trunk/build/src/external/php-7.0.0RC1/Zend/zend_vm_execute.h:450
#15 0x00000000006db7f5 in zend_execute_scripts (type=8,
retval=0x7ffff1200000, retval@entry=0x0, file_count=3)
at
/home/canavan/fit/trunk/build/src/external/php-7.0.0RC1/Zend/zend.c:1404
#16 0x000000000066ffe8 in php_execute_script
(primary_file=0x7fffffffc6a0) at
/home/canavan/fit/trunk/build/src/external/php-7.0.0RC1/main/main.c:2475
#17 0x000000000079278b in do_cli (argc=33, argv=0x7ffff1200000) at
/home/canavan/fit/trunk/build/src/external/php-7.0.0RC1/sapi/cli/php_cli.c:971
#18 0x0000000000429130 in main (argc=33, argv=0x7ffff1200000) at
/home/canavan/fit/trunk/build/src/external/php-7.0.0RC1/sapi/cli/php_cli.c:1338
Test script:
---------------
<?php
$dom = new DOMDocument();
$dom->load('sitemap.xml');
if ($dom->documentElement) {
if ($spaceNode = $dom->documentElement->getAttributeNode('xmlns'))
{
print_r($spaceNode,1);
}
}
?>
with sitemap.xml
<?xml version="1.0" encoding="UTF-8"?>
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9"
xmlns:xsi="fooooooooooooooooooooo">
</urlset>
Expected result:
----------------
No segfault, possibly an error or warning.
Affects PHP 5.6.11 as well as 7.0-rc1
--
Edit bug report at https://bugs.php.net/bug.php?id=70359&edit=1
--
Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=70359&r=trysnapshot54
Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=70359&r=trysnapshot55
Try a snapshot (trunk): https://bugs.php.net/fix.php?id=70359&r=trysnapshottrunk
Fixed in SVN: https://bugs.php.net/fix.php?id=70359&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=70359&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=70359&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=70359&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=70359&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=70359&r=support
Expected behavior: https://bugs.php.net/fix.php?id=70359&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=70359&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=70359&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=70359&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=70359&r=php4
Daylight Savings: https://bugs.php.net/fix.php?id=70359&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=70359&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=70359&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=70359&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=70359&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=70359&r=mysqlcfg