Bug #70535 [NEW]: XSLT: free(): invalid pointer

From: lalalalalalala at emailn dot de Operating system: Windows 10 / Debian 8.2 PHP version: 7.0.0RC3 Package: XSLT related Bug Type: Bug Bug description:XSLT: free(): invalid pointer Description: ------------ Windows (x64 with 32 bit PHP): PHP 7.0.0RC3 (cli) (built: Sep 16 2015 13:41:53) Copyright (c) 1997-2015 The PHP Group Zend Engine v3.0.0-dev, Copyright (c) 1998-2015 Zend Technologies Debian (armv7l): PHP 7.0.0RC3 (cli) (built: Sep 17 2015 22:12:59) Copyright (c) 1997-2015 The PHP Group Zend Engine v3.0.0-dev, Copyright (c) 1998-2015 Zend Technologies with Zend OPcache v7.0.6-dev, Copyright (c) 1999-2015, by Zend Technologies Windows: Downloaded from http://windows.php.net/qa/ (VC14 x86 Thread Safe (2015-Sep-17 00:25:13) Debian: Build with https://github.com/php-build/php-build (0df4c0c) Using default php.ini (with enabled extension on windows: php_xsl) Calling XSLTProcessor::transformToXML crashes PHP. Stacktrace (Debug Diagnostic Tool) Entry point php!mainCRTStartup Create time 20.09.2015 13:14:38 Time spent in user mode 0 Days 00:00:00.015 Time spent in kernel mode 0 Days 00:00:00.015 ntdll!RtlReportCriticalFailure+83 ntdll!RtlpHeapHandleError+1c ntdll!RtlpLogHeapFailure+9f ntdll!RtlpFreeHeapInternal+ed ntdll!RtlFreeHeap+2c AcLayers!NS_FaultTolerantHeap::APIHook_RtlFreeHeap+418 ucrtbase!free+1b php7ts!xmlFreeNodeList+156 Test script: --------------- <?php $xmlInput = simplexml_load_string('<root></root>'); $xslInput = '<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"><xsl:template match="root"><xsl:text>success</xsl:text></xsl:template></xsl:stylesheet>'; $xsl = new \DomDocument(); $xsl->loadXML($xslInput); $xslt = new \XsltProcessor(); $xslt->importStylesheet($xsl); $xmloutput = $xslt->transformToXml($xmlInput); echo $xmloutput; Expected result: ---------------- Output and no crash (works fine on 5.6.13): <?xml version="1.0"?> success Actual result: -------------- On Windows: Output: <?xml version="1.0"?> success After that: Windows popup: "CLI has stopped working - A problem caused the program to stop working correctly. Windows will close the program and notify you if a solution is available." On Debian: <?xml version="1.0"?> success *** Error in `php': free(): invalid pointer: 0x009d994b *** Aborted Even after several runs, the pointer remains the same. -- Edit bug report at https://bugs.php.net/bug.php?id=70535&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=70535&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=70535&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=70535&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=70535&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=70535&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=70535&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=70535&r=needscript Try newer version: https://bugs.php.net/fix.php?id=70535&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=70535&r=support Expected behavior: https://bugs.php.net/fix.php?id=70535&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=70535&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=70535&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=70535&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=70535&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=70535&r=dst IIS Stability: https://bugs.php.net/fix.php?id=70535&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=70535&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=70535&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=70535&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=70535&r=mysqlcfg