PHP 4.0 Bug #8567: Crash using xml_parser

From: icon@mricon.com Operating system: Linux-2.2.16 (SuSE-7.0), 2.2.18 (SlackWare-7.0) PHP version: 4.0.4 PHP Bug Type: Reproduceable crash Bug description: Crash using xml_parser Calling xml_parser causes a SegFault. Confirmed on a simple example from documentation on two different machines running different apache versions, but same 4.0.4. SuSE gdb: #0 0x40184635 in call_user_function_ex () at zend_execute_API.c:102 #1 0x4018448c in call_user_function () at zend_execute_API.c:102 #2 0x40207375 in xml_call_handler (parser=0x814f394, handler=0x813e464, argc=3, argv=0xbfffc0a0) at xml.c:361 #3 0x40207bbb in _xml_startElementHandler () at xml.c:604 #4 0x4020b8c7 in doContent (parser=0x813b630, startTagLevel=0, enc=0x4024a3c0, s=0x815d44a "<quizset>\n<quiztitle>Sample quiz</quiztitle>\n<questionsets>\n<questionset id=\"0\">\n<question>Roses are red, violets are</question>\n<answerset>\n<answer>scarlet</answer>\n<answer correct=\"yes\">blue</answer"..., end=0x815d932 "", nextPtr=0xbfffc228) at xmlparse.c:1268 #5 0x4020b082 in contentProcessor (parser=0x813b630, start=0x815d44a "<quizset>\n<quiztitle>Sample quiz</quiztitle>\n<questionsets>\n<questionset id=\"0\">\n<question>Roses are red, violets are</question>\n<answerset>\n<answer>scarlet</answer>\n<answer correct=\"yes\">blue</answer"..., end=0x815d932 "", endPtr=0xbfffc228) at xmlparse.c:957 #6 0x4020d0a6 in prologProcessor (parser=0x813b630, s=0x815d44a "<quizset>\n<quiztitle>Sample quiz</quiztitle>\n<questionsets>\n<questionset id=\"0\">\n<question>Roses are red, violets are</question>\n<answerset>\n<answer>scarlet</answer>\n<answer correct=\"yes\">blue</answer"..., end=0x815d932 "", nextPtr=0xbfffc228) at xmlparse.c:2036 #7 0x4020cda5 in prologInitProcessor (parser=0x813b630, s=0x815d434 "<?xml version=\"1.0\"?>\n<quizset>\n<quiztitle>Sample quiz</quiztitle>\n<questionsets>\n<questionset id=\"0\">\n<question>Roses are red, violets are</question>\n<answerset>\n<answer>scarlet</answer>\n<answer corr"..., end=0x815d932 "", nextPtr=0xbfffc228) at xmlparse.c:1967 #8 0x4020abab in php_XML_Parse () at xmlparse.c:596 #9 0x4020912d in php_if_xml_parse () at xml.c:604 #10 0x4017e179 in execute () at ./zend_execute.c:877 #11 0x4018065a in execute () at ./zend_execute.c:877 #12 0x4018065a in execute () at ./zend_execute.c:877 #13 0x4018065a in execute () at ./zend_execute.c:877 #14 0x4018cfb6 in zend_execute_scripts () at zend.c:258 #15 0x4019fc44 in php_execute_script () at main.c:1153 #16 0x4019bf10 in apache_php_module_main () at sapi_apache.c:98 #17 0x4019c939 in send_php () at mod_php4.c:433 #18 0x4019c983 in send_parsed_php () at mod_php4.c:433 #19 0x806c259 in ap_invoke_handler () #20 0x80814cf in process_request_internal () #21 0x8081542 in ap_process_request () #22 0x80783e6 in child_main () #23 0x80785a5 in make_child () #24 0x8078726 in startup_children () #25 0x8078d9d in standalone_main () #26 0x80795cc in main () #27 0x40087a8e in __libc_start_main () at ../sysdeps/generic/libc-start.c:93 configure line: ./configure --with-apxs=/usr/local/apache/bin/apxs --with-mysql=/usr --with-dom=/usr/local/dom2 --enable-track-vars -- Edit Bug report at: http://bugs.php.net/?id=8567&edit=1