#34952 [Opn->Fbk]: double free when passing node from external document() to a PHP function

From: Date: Fri, 21 Oct 2005 20:59:08 +0000
Subject: #34952 [Opn->Fbk]: double free when passing node from external document() to a PHP function
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-86904@lists.php.net to get a copy of this message 
 ID:               34952
 Updated by:       tony2001@php.net
 Reported By:      theo at crazygreek dot co dot uk
-Status:           Open
+Status:           Feedback
 Bug Type:         XSLT related
 Operating System: Linux
 PHP Version:      5.0.5
 New Comment:

Please try using this CVS snapshot:

  http://snaps.php.net/php5-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php5-win32-latest.zip




Previous Comments:
------------------------------------------------------------------------

[2005-10-21 22:57:48] theo at crazygreek dot co dot uk

Description:
------------
Performing a PHP callback from within an XSLT template with a parameter
of an element that is inside a external XML document causes a double
free, followed by crash.  Running latest stable PHP.

Reproduce code:
---------------
=========
crash.php
=========

  $xslt = new XsltProcessor();
  $xslt->registerPHPFunctions();
  $xslt->importStyleSheet(DOMDocument::load('test.xsl'));

  echo $xslt->transformToDoc(new DOMDocument())->saveXml();

  function crashMe() {
    return null;
  }

=========
crash.xsl
=========

<xsl:stylesheet 
   xmlns:xsl="http://www.w3.org/1999/XSL/Transform" 
   xmlns:php="http://php.net/xsl"
version="1.0">

  <xsl:template match="/">
    <xsl:copy-of select="php:function('crashMe',
document('crash.xml'))"/>
  </xsl:template>

</xsl:stylesheet>

=========
crash.xml
=========

<?xml version="1.0"?>
<crashed/>

Expected result:
----------------
Just the following:

<?xml version="1.0"?>


Actual result:
--------------
A crash!

*** glibc detected *** double free or corruption (fasttop): 0x085d8540
***
Aborted



------------------------------------------------------------------------


-- 
Edit this bug report at http://bugs.php.net/?id=34952&edit=1

Thread (6 messages)

« previous php.bugs (#86904) next »