svn: /php/php-src/ branches/PHP_5_3/NEWS branches/PHP_5_3/ext/dom/tests/bug54601.phpt branches/PHP_5_3/ext/libxml/libxml.c
branches/PHP_5_4/ext/dom/tests/bug54601.phpt branches/PHP_5_4/ext/libxml/libxml.c trunk/ext/dom/tests/bug54601.phpt trunk/ext/libxml/libxml.c

bjori Sun, 29 May 2011 11:39:49 +0000 Revision: http://svn.php.net/viewvc?view=revision&revision=311544 Log: Fixed bug #54601 (Removing the doctype node segfaults) Bug: http://bugs.php.net/54601 (Assigned) Removing the doctype node segfaults Changed paths: U php/php-src/branches/PHP_5_3/NEWS A php/php-src/branches/PHP_5_3/ext/dom/tests/bug54601.phpt U php/php-src/branches/PHP_5_3/ext/libxml/libxml.c A php/php-src/branches/PHP_5_4/ext/dom/tests/bug54601.phpt U php/php-src/branches/PHP_5_4/ext/libxml/libxml.c A php/php-src/trunk/ext/dom/tests/bug54601.phpt U php/php-src/trunk/ext/libxml/libxml.c Modified: php/php-src/branches/PHP_5_3/NEWS =================================================================== --- php/php-src/branches/PHP_5_3/NEWS 2011-05-29 10:23:06 UTC (rev 311543) +++ php/php-src/branches/PHP_5_3/NEWS 2011-05-29 11:39:49 UTC (rev 311544) @@ -91,6 +91,7 @@ libraries). (Clint Byrum, Raphael) - libxml extension: + . Fixed bug #54601 (Removing the doctype node segfaults). (Hannes) . Fixed bug #54440 (libxml extension ignores default context). (Gustavo) - mbstring extension: Added: php/php-src/branches/PHP_5_3/ext/dom/tests/bug54601.phpt =================================================================== --- php/php-src/branches/PHP_5_3/ext/dom/tests/bug54601.phpt (rev 0) +++ php/php-src/branches/PHP_5_3/ext/dom/tests/bug54601.phpt 2011-05-29 11:39:49 UTC (rev 311544) @@ -0,0 +1,30 @@ +--TEST-- +Segfault when removing the Doctype node +--SKIPIF-- +<?php require_once('skipif.inc'); ?> +--FILE-- +<?php +$xml = <<< XML +<?xml version='1.0' encoding='utf-8' ?> +<!DOCTYPE set PUBLIC "-//OASIS//DTD DocBook XML V5.0//EN" "http://www.docbook.org/xml/5.0/dtd/docbook.dtd" [ +<!ENTITY foo '<foo>footext</foo>'> +<!ENTITY bar '<bar>bartext</bar>'> +]> +<set>&foo;&bar;</set> +XML; + +$doc = new DOMDocument(); +$doc->loadXML($xml, LIBXML_NOENT); +$n = $doc->doctype; +$doc->removeChild($n); +var_dump($n); +print $doc->saveXML(); +?> +===DONE=== +<?php exit(0); ?> +--EXPECTF-- +object(DOMDocumentType)#%d (0) { +} +<?xml version="1.0" encoding="utf-8"?> +<set><foo>footext</foo><bar>bartext</bar></set> +===DONE=== Modified: php/php-src/branches/PHP_5_3/ext/libxml/libxml.c =================================================================== --- php/php-src/branches/PHP_5_3/ext/libxml/libxml.c 2011-05-29 10:23:06 UTC (rev 311543) +++ php/php-src/branches/PHP_5_3/ext/libxml/libxml.c 2011-05-29 11:39:49 UTC (rev 311544) @@ -222,6 +222,7 @@ switch (node->type) { /* Skip property freeing for the following types */ case XML_NOTATION_NODE: + case XML_ENTITY_DECL: break; case XML_ENTITY_REF_NODE: php_libxml_node_free_list((xmlNodePtr) node->properties TSRMLS_CC); @@ -233,7 +234,6 @@ case XML_ATTRIBUTE_DECL: case XML_DTD_NODE: case XML_DOCUMENT_TYPE_NODE: - case XML_ENTITY_DECL: case XML_NAMESPACE_DECL: case XML_TEXT_NODE: php_libxml_node_free_list(node->children TSRMLS_CC); Added: php/php-src/branches/PHP_5_4/ext/dom/tests/bug54601.phpt =================================================================== --- php/php-src/branches/PHP_5_4/ext/dom/tests/bug54601.phpt (rev 0) +++ php/php-src/branches/PHP_5_4/ext/dom/tests/bug54601.phpt 2011-05-29 11:39:49 UTC (rev 311544) @@ -0,0 +1,30 @@ +--TEST-- +Segfault when removing the Doctype node +--SKIPIF-- +<?php require_once('skipif.inc'); ?> +--FILE-- +<?php +$xml = <<< XML +<?xml version='1.0' encoding='utf-8' ?> +<!DOCTYPE set PUBLIC "-//OASIS//DTD DocBook XML V5.0//EN" "http://www.docbook.org/xml/5.0/dtd/docbook.dtd" [ +<!ENTITY foo '<foo>footext</foo>'> +<!ENTITY bar '<bar>bartext</bar>'> +]> +<set>&foo;&bar;</set> +XML; + +$doc = new DOMDocument(); +$doc->loadXML($xml, LIBXML_NOENT); +$n = $doc->doctype; +$doc->removeChild($n); +var_dump($n); +print $doc->saveXML(); +?> +===DONE=== +<?php exit(0); ?> +--EXPECTF-- +object(DOMDocumentType)#%d (0) { +} +<?xml version="1.0" encoding="utf-8"?> +<set><foo>footext</foo><bar>bartext</bar></set> +===DONE=== Modified: php/php-src/branches/PHP_5_4/ext/libxml/libxml.c =================================================================== --- php/php-src/branches/PHP_5_4/ext/libxml/libxml.c 2011-05-29 10:23:06 UTC (rev 311543) +++ php/php-src/branches/PHP_5_4/ext/libxml/libxml.c 2011-05-29 11:39:49 UTC (rev 311544) @@ -224,6 +224,7 @@ switch (node->type) { /* Skip property freeing for the following types */ case XML_NOTATION_NODE: + case XML_ENTITY_DECL: break; case XML_ENTITY_REF_NODE: php_libxml_node_free_list((xmlNodePtr) node->properties TSRMLS_CC); @@ -235,7 +236,6 @@ case XML_ATTRIBUTE_DECL: case XML_DTD_NODE: case XML_DOCUMENT_TYPE_NODE: - case XML_ENTITY_DECL: case XML_NAMESPACE_DECL: case XML_TEXT_NODE: php_libxml_node_free_list(node->children TSRMLS_CC); Added: php/php-src/trunk/ext/dom/tests/bug54601.phpt =================================================================== --- php/php-src/trunk/ext/dom/tests/bug54601.phpt (rev 0) +++ php/php-src/trunk/ext/dom/tests/bug54601.phpt 2011-05-29 11:39:49 UTC (rev 311544) @@ -0,0 +1,30 @@ +--TEST-- +Segfault when removing the Doctype node +--SKIPIF-- +<?php require_once('skipif.inc'); ?> +--FILE-- +<?php +$xml = <<< XML +<?xml version='1.0' encoding='utf-8' ?> +<!DOCTYPE set PUBLIC "-//OASIS//DTD DocBook XML V5.0//EN" "http://www.docbook.org/xml/5.0/dtd/docbook.dtd" [ +<!ENTITY foo '<foo>footext</foo>'> +<!ENTITY bar '<bar>bartext</bar>'> +]> +<set>&foo;&bar;</set> +XML; + +$doc = new DOMDocument(); +$doc->loadXML($xml, LIBXML_NOENT); +$n = $doc->doctype; +$doc->removeChild($n); +var_dump($n); +print $doc->saveXML(); +?> +===DONE=== +<?php exit(0); ?> +--EXPECTF-- +object(DOMDocumentType)#%d (0) { +} +<?xml version="1.0" encoding="utf-8"?> +<set><foo>footext</foo><bar>bartext</bar></set> +===DONE=== Modified: php/php-src/trunk/ext/libxml/libxml.c =================================================================== --- php/php-src/trunk/ext/libxml/libxml.c 2011-05-29 10:23:06 UTC (rev 311543) +++ php/php-src/trunk/ext/libxml/libxml.c 2011-05-29 11:39:49 UTC (rev 311544) @@ -224,6 +224,7 @@ switch (node->type) { /* Skip property freeing for the following types */ case XML_NOTATION_NODE: + case XML_ENTITY_DECL: break; case XML_ENTITY_REF_NODE: php_libxml_node_free_list((xmlNodePtr) node->properties TSRMLS_CC); @@ -235,7 +236,6 @@ case XML_ATTRIBUTE_DECL: case XML_DTD_NODE: case XML_DOCUMENT_TYPE_NODE: - case XML_ENTITY_DECL: case XML_NAMESPACE_DECL: case XML_TEXT_NODE: php_libxml_node_free_list(node->children TSRMLS_CC);