ID:               42728
 Updated by:       [EMAIL PROTECTED]
 Reported By:      nyos at nyos dot homelinux dot net
-Status:           Open
+Status:           Feedback
 Bug Type:         Reproducible crash
 Operating System: Kubuntu linux 7.04 Feisty Fawn
 PHP Version:      5.2.4
 New Comment:

Thank you for this bug report. To properly diagnose the problem, we
need a backtrace to see what is happening behind the scenes. To
find out how to generate a backtrace, please read
http://bugs.php.net/bugs-generating-backtrace.php for *NIX and
http://bugs.php.net/bugs-generating-backtrace-win32.php for Win32

Once you have generated a backtrace, please submit it to this bug
report and change the status back to "Open". Thank you for helping
us make PHP better.




Previous Comments:
------------------------------------------------------------------------

[2007-09-21 14:50:38] nyos at nyos dot homelinux dot net

Description:
------------
Tidy (libtidy, php-tidy) fails on a (syntactically) incorrect page.
This mustn't happen of course.
A segmentation fault might be caused by a buffer overrun, or a
wandering pointer, which might be a security issue as well. (However,
breaking into a bot using tidy through this bug is very unlikely.)
Tidy's purpose is to correct incorrect pages, so it needs to be
error-proof.

versions: ubuntu feisty default install + kubuntu-desktop + up-to date
system, however, I'm not sure even if it's a bug in php or in tidy
Package: tidy Version: 20051018-1
Package: libtidy-0.99-0 Version: 20051018-1
Package: php5-tidy Version: 5.2.1-0ubuntu1.4
(this is the newest version in package, but I didn't see anything about
this bug, so possibly it's still a bug)

Reproduce code:
---------------
<?
/* // this won't work either
  $file_data='
  <html>
    <frameset >
    </frameset>
  </html>
  ';
*/
  $file_data='
    <frameset >
    </frameset>
  ';

  $t=tidy_parse_string(trim($file_data));
  $t->cleanRepair();

  echo "following line segfaults..\n";
  $body=tidy_get_body($t);
  echo "..or works?\n";
?>

Expected result:
----------------
$body=null, warning, or anything else..

Actual result:
--------------
[EMAIL PROTECTED]:~/webmasters/tidybug$ ./tidy.php
following line segfaults..
Segmentation fault (core dumped)



------------------------------------------------------------------------


-- 
Edit this bug report at http://bugs.php.net/?id=42728&edit=1

Reply via email to