#36776 [NEW]: node_list_wrapper_dtor segfault

From: rasmus@php.net Operating system: Linux PHP version: 4CVS-2006-03-17 (CVS) PHP Bug Type: DOM XML related Bug description: node_list_wrapper_dtor segfault Description: ------------ It looks like the node_list_wrapper_dtor function gets confused and ends up segfaulting. Reproduce code: --------------- <?php $xml=<<<EOB <?xml version="1.0" standalone="no"?> <!DOCTYPE items [ <!ATTLIST items attr CDATA #REQUIRED> <!ELEMENT item EMPTY> <!ELEMENT items (item)+> ]> <items attr="test"><item/> <item/></items> EOB; domxml_open_mem($xml); ?> Expected result: ---------------- no segfault Actual result: -------------- segfault With this backtrace: Program received signal SIGSEGV, Segmentation fault. [Switching to Thread -1218013504 (LWP 6708)] 0x0809ec35 in node_list_wrapper_dtor (node=0x0, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:645 645 { (gdb) bt #0 0x0809ec35 in node_list_wrapper_dtor (node=0x0, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:645 #1 0x0809ec51 in node_list_wrapper_dtor (node=0x82ba970, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:647 #2 0x0809ec8d in node_list_wrapper_dtor (node=0x82bc1e8, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:659 #3 0x0809ec8d in node_list_wrapper_dtor (node=0x82bc1e8, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:659 #4 0x0809ec8d in node_list_wrapper_dtor (node=0x82bc1e8, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:659 #5 0x0809ec8d in node_list_wrapper_dtor (node=0x82bc1e8, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:659 #6 0x0809ec8d in node_list_wrapper_dtor (node=0x82bc1e8, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:659 #7 0x0809ec8d in node_list_wrapper_dtor (node=0x82bc1e8, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:659 #8 0x0809ec8d in node_list_wrapper_dtor (node=0x82bc1e8, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:659 #9 0x0809ec8d in node_list_wrapper_dtor (node=0x82bc1e8, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:659 #10 0x0809ec8d in node_list_wrapper_dtor (node=0x82bc1e8, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:659 ... thousands more lines like the above. -- Edit bug report at http://bugs.php.net/?id=36776&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=36776&r=trysnapshot44 Try a CVS snapshot (PHP 5.1): http://bugs.php.net/fix.php?id=36776&r=trysnapshot51 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=36776&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=36776&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=36776&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=36776&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=36776&r=needscript Try newer version: http://bugs.php.net/fix.php?id=36776&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=36776&r=support Expected behavior: http://bugs.php.net/fix.php?id=36776&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=36776&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=36776&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=36776&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=36776&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=36776&r=dst IIS Stability: http://bugs.php.net/fix.php?id=36776&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=36776&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=36776&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=36776&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=36776&r=mysqlcfg