Bug #78577 [NEW]: Crash in DOMNameSpace debug info handlers

From: beberlei Operating system: Any PHP version: 7.3.9 Package: DOM XML related Bug Type: Bug Bug description:Crash in DOMNameSpace debug info handlers Description: ------------ When calling var_dump on a DOMNameSpaceNode representing the "xmlns" namespace (not on other namespaces). Test script: --------------- <?php $doc = DOMDocument::loadXML('<foo xmlns="http://php.net/test" xmlns:foo="urn:foo" />'); $attr = $doc->documentElement->getAttributeNode('xmlns'); var_dump($attr); Actual result: -------------- Program received signal SIGSEGV, Segmentation fault. 0x00005555556faedb in php_libxml_node_free_list (node=0x21) at /opt/phpbuild/7.3/php-7.3.8/ext/libxml/libxml.c:233 233 switch (node->type) { (gdb) bt #0 0x00005555556faedb in php_libxml_node_free_list (node=0x21) at /opt/phpbuild/7.3/php-7.3.8/ext/libxml/libxml.c:233 #1 0x00005555556faf69 in php_libxml_node_free_list (node=0x55555678b3b0) at /opt/phpbuild/7.3/php-7.3.8/ext/libxml/libxml.c:253 #2 0x00005555556fe3fd in php_libxml_node_free_resource (node=0x55555678b530) at /opt/phpbuild/7.3/php-7.3.8/ext/libxml/libxml.c:1300 #3 0x00005555556fe4dc in php_libxml_node_decrement_resource (object=0x7ffff5464960) at /opt/phpbuild/7.3/php-7.3.8/ext/libxml/libxml.c:1335 #4 0x000055555590ce71 in dom_objects_free_storage (object=0x7ffff5464978) at /opt/phpbuild/7.3/php-7.3.8/ext/dom/php_dom.c:1042 #5 0x0000555555cf3819 in zend_objects_store_del (object=0x7ffff5464978) at /opt/phpbuild/7.3/php-7.3.8/Zend/zend_objects_API.c:190 #6 0x0000555555c9a079 in zend_object_destroy_wrapper (obj=0x7ffff5464978) at /opt/phpbuild/7.3/php-7.3.8/Zend/zend_variables.c:95 #7 0x0000555555c99ee9 in rc_dtor_func (p=0x7ffff5464978) at /opt/phpbuild/7.3/php-7.3.8/Zend/zend_variables.c:65 #8 0x0000555555c99e6c in i_zval_ptr_dtor (zval_ptr=0x7fffffff9fd0, __zend_filename=0x555556435b38 "/opt/phpbuild/7.3/php-7.3.8/Zend/zend_variables.c", __zend_lineno=111) at /opt/phpbuild/7.3/php-7.3.8/Zend/zend_variables.h:44 #9 0x0000555555c9a0d6 in zval_ptr_dtor (zval_ptr=0x7fffffff9fd0) at /opt/phpbuild/7.3/php-7.3.8/Zend/zend_variables.c:111 #10 0x0000555555909730 in dom_get_debug_info_helper (object=0x7ffff541f150, is_temp=0x7fffffffa03c) at /opt/phpbuild/7.3/php-7.3.8/ext/dom/php_dom.c:440 #11 0x00005555559097e6 in dom_get_debug_info (object=0x7ffff541f150, is_temp=0x7fffffffa03c) at /opt/phpbuild/7.3/php-7.3.8/ext/dom/php_dom.c:456 #12 0x0000555555b47743 in php_var_dump (struc=0x7ffff541f150, level=1) at /opt/phpbuild/7.3/php-7.3.8/ext/standard/var.c:148 #13 0x0000555555b47ce7 in zif_var_dump (execute_data=0x7ffff541f100, return_value=0x7fffffffa1a0) at /opt/phpbuild/7.3/php-7.3.8/ext/standard/var.c:205 #14 0x0000555555d069b0 in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER () at /opt/phpbuild/7.3/php-7.3.8/Zend/zend_vm_execute.h:645 #15 0x0000555555d73f57 in execute_ex (ex=0x7ffff541f030) at /opt/phpbuild/7.3/php-7.3.8/Zend/zend_vm_execute.h:55461 #16 0x0000555555d7958a in zend_execute (op_array=0x7ffff5482300, return_value=0x0) at /opt/phpbuild/7.3/php-7.3.8/Zend/zend_vm_execute.h:60881 #17 0x0000555555c9dfa4 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /opt/phpbuild/7.3/php-7.3.8/Zend/zend.c:1568 #18 0x0000555555c03d2e in php_execute_script (primary_file=0x7fffffffc9a0) at /opt/phpbuild/7.3/php-7.3.8/main/main.c:2634 #19 0x0000555555d7c3a3 in do_cli (argc=2, argv=0x555556617640) at /opt/phpbuild/7.3/php-7.3.8/sapi/cli/php_cli.c:997 #20 0x0000555555d7d532 in main (argc=2, argv=0x555556617640) at /opt/phpbuild/7.3/php-7.3.8/sapi/cli/php_cli.c:1389 -- Edit bug report at https://bugs.php.net/bug.php?id=78577&edit=1 -- Fix committed: https://bugs.php.net/fix.php?id=78577&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=78577&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=78577&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=78577&r=needscript Try newer version: https://bugs.php.net/fix.php?id=78577&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=78577&r=support Expected behavior: https://bugs.php.net/fix.php?id=78577&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=78577&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=78577&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=78577&r=globals PHP version support discontinued: https://bugs.php.net/fix.php?id=78577&r=phptooold Daylight Savings: https://bugs.php.net/fix.php?id=78577&r=dst IIS Stability: https://bugs.php.net/fix.php?id=78577&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=78577&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=78577&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=78577&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=78577&r=mysqlcfg