#32755 [NEW]: Segfault in replaceChild() when DocumentFragment has no children
From: james at safesearching dot com
Operating system: RedHat 7.3
PHP version: 5CVS-2005-04-18 (dev)
PHP Bug Type: DOM XML related
Bug description: Segfault in replaceChild() when DocumentFragment has no children
Description:
------------
Segfault occurs when calling DOMNode::replaceChild($newNode, $oldNode) if
$newNode is a DocumentFragment with no children.
The segfault occurs on line 62 of ext/dom/node.c:
dom_reconcile_ns (doc=0x81aff20, nodep=0x0)
at /home/james/php5-STABLE-200504182039/ext/dom/node.c:62
62 if (nodep->type == XML_ELEMENT_NODE) {
Code runs test against nodep->type when nodep is NULL.
Was tested on both 5.0.4 (w/ node.c,v 1.29.2.4) and 5.0.5-dev
(STABLE-200504182039).
Reproduce code:
---------------
<?php
header('Content-type: text/plain;');
$xml = "<root><first/><second/></root>\n";
$dom = new DomDocument;
$dom->loadXML($xml);
$root = $dom->documentElement;
$frag = $dom->createDocumentFragment();
$root->replaceChild($frag, $root->firstChild);
print_r($dom->saveXML());
?>
Expected result:
----------------
Not exactlly sure... perhaps issue a warning indicating that the
DocumentFragment object had no children and remove oldNode? Maybe generate
a fatal error?
Actual result:
--------------
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1024 (LWP 27878)]
dom_reconcile_ns (doc=0x81d0540, nodep=0x0)
at /home/james/php5-STABLE-200504182039/ext/dom/node.c:62
62 if (nodep->type == NULL) {
--
Edit bug report at http://bugs.php.net/?id=32755&edit=1
--
Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=32755&r=trysnapshot4
Try a CVS snapshot (php5.0): http://bugs.php.net/fix.php?id=32755&r=trysnapshot50
Try a CVS snapshot (php5.1): http://bugs.php.net/fix.php?id=32755&r=trysnapshot51
Fixed in CVS: http://bugs.php.net/fix.php?id=32755&r=fixedcvs
Fixed in release: http://bugs.php.net/fix.php?id=32755&r=alreadyfixed
Need backtrace: http://bugs.php.net/fix.php?id=32755&r=needtrace
Need Reproduce Script: http://bugs.php.net/fix.php?id=32755&r=needscript
Try newer version: http://bugs.php.net/fix.php?id=32755&r=oldversion
Not developer issue: http://bugs.php.net/fix.php?id=32755&r=support
Expected behavior: http://bugs.php.net/fix.php?id=32755&r=notwrong
Not enough info: http://bugs.php.net/fix.php?id=32755&r=notenoughinfo
Submitted twice: http://bugs.php.net/fix.php?id=32755&r=submittedtwice
register_globals: http://bugs.php.net/fix.php?id=32755&r=globals
PHP 3 support discontinued: http://bugs.php.net/fix.php?id=32755&r=php3
Daylight Savings: http://bugs.php.net/fix.php?id=32755&r=dst
IIS Stability: http://bugs.php.net/fix.php?id=32755&r=isapi
Install GNU Sed: http://bugs.php.net/fix.php?id=32755&r=gnused
Floating point limitations: http://bugs.php.net/fix.php?id=32755&r=float
No Zend Extensions: http://bugs.php.net/fix.php?id=32755&r=nozend
MySQL Configuration Error: http://bugs.php.net/fix.php?id=32755&r=mysqlcfg
Thread (3 messages)
- james at safesearching dot com