Bug #79968 [PATCH]: DOMText::before() crashes

From: Date: Sat, 15 Aug 2020 08:54:05 +0000
Subject: Bug #79968 [PATCH]: DOMText::before() crashes
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-228600@lists.php.net to get a copy of this message 
Edit report at https://bugs.php.net/bug.php?id=79968&edit=1

 ID:                 79968
 Patch added by:     beberlei@php.net
 Reported by:        nikic@php.net
 Summary:            DOMText::before() crashes
 Status:             Assigned
 Type:               Bug
 Package:            DOM XML related
 PHP Version:        8.0.0beta1
 Assigned To:        beberlei
 Block user comment: N
 Private report:     N

 New Comment:

The following pull request has been associated:

Patch Name: Fix #79968: Manipulation on unattached DOMChildNode should throw DOMException
On GitHub:  https://github.com/php/php-src/pull/5990
Patch:      https://github.com/php/php-src/pull/5990.patch


Previous Comments:
------------------------------------------------------------------------
[2020-08-15 08:38:18] beberlei@php.net

According to the spec, for an element that has its hierachy preconditions fail an exception should
be thrown:

node . before(...nodes)

    Inserts nodes just before node, while replacing strings in nodes with equivalent Text nodes.

    Throws a "HierarchyRequestError" DOMException if the constraints of the node tree are
violated.

It looks this is not implemented and causes the segfault.

------------------------------------------------------------------------
[2020-08-13 11:06:15] nikic@php.net

Description:
------------
<?php
$cdata = new DOMText;
$cdata->before(null);

==441255== Invalid read of size 4
==441255==    at 0x488E30: dom_zvals_to_fragment (parentnode.c:137)
==441255==    by 0x489514: dom_parent_node_before (parentnode.c:339)
==441255==    by 0x494744: zim_DOMCharacterData_before (characterdata.c:428)
==441255==    by 0x9FA8B4: ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER (zend_vm_execute.h:1618)
==441255==    by 0xA678B8: execute_ex (zend_vm_execute.h:53562)
==441255==    by 0xA6CA21: zend_execute (zend_vm_execute.h:57766)
==441255==    by 0x9C134B: zend_execute_scripts (zend.c:1696)
==441255==    by 0x923E4E: php_execute_script (main.c:2535)
==441255==    by 0xAABE2F: do_cli (php_cli.c:949)
==441255==    by 0xAACE6E: main (php_cli.c:1336)
==441255==  Address 0x8 is not stack'd, malloc'd or (recently) free'd




------------------------------------------------------------------------



--
Edit this bug report at https://bugs.php.net/bug.php?id=79968&edit=1

Thread (4 messages)

« previous php.bugs (#228600) next »