[PHP-CVS] cvs: php-src /ext/libxml libxml.c /ext/simplexml simplexml.c /ext/simplexml/tests bug38347.phpt

[Antony Dovgal]

tony2001                Sun Aug  6 17:41:39 2006 UTC

  Added files:                 
    /php-src/ext/simplexml/tests        bug38347.phpt 

  Modified files:              
    /php-src/ext/libxml libxml.c 
    /php-src/ext/simplexml      simplexml.c 
  Log:
  fix #38347 (Segmentation fault when using foreach with an unknown/empty 
SimpleXMLElement)
  
  
http://cvs.php.net/viewvc.cgi/php-src/ext/libxml/libxml.c?r1=1.50&r2=1.51&diff_format=u
Index: php-src/ext/libxml/libxml.c
diff -u php-src/ext/libxml/libxml.c:1.50 php-src/ext/libxml/libxml.c:1.51
--- php-src/ext/libxml/libxml.c:1.50    Tue Jul  4 07:34:32 2006
+++ php-src/ext/libxml/libxml.c Sun Aug  6 17:41:39 2006
@@ -17,7 +17,7 @@
    +----------------------------------------------------------------------+
  */
 
-/* $Id: libxml.c,v 1.50 2006/07/04 07:34:32 dmitry Exp $ */
+/* $Id: libxml.c,v 1.51 2006/08/06 17:41:39 tony2001 Exp $ */
 
 #define IS_EXT_MODULE
 
@@ -976,8 +976,8 @@
                                efree(object->document->doc_props);
                        }
                        efree(object->document);
+                       object->document = NULL;
                }
-               object->document = NULL;
        }
 
        return ret_refcount;
@@ -1035,6 +1035,8 @@
                                obj_node->_private = NULL;
                        }
                }
+       }
+       if (object != NULL && object->document != NULL) {
                /* Safe to call as if the resource were freed then doc pointer 
is NULL */
                php_libxml_decrement_doc_ref(object TSRMLS_CC);
        }
http://cvs.php.net/viewvc.cgi/php-src/ext/simplexml/simplexml.c?r1=1.211&r2=1.212&diff_format=u
Index: php-src/ext/simplexml/simplexml.c
diff -u php-src/ext/simplexml/simplexml.c:1.211 
php-src/ext/simplexml/simplexml.c:1.212
--- php-src/ext/simplexml/simplexml.c:1.211     Sun Aug  6 13:27:38 2006
+++ php-src/ext/simplexml/simplexml.c   Sun Aug  6 17:41:39 2006
@@ -18,7 +18,7 @@
   +----------------------------------------------------------------------+
 */
 
-/* $Id: simplexml.c,v 1.211 2006/08/06 13:27:38 tony2001 Exp $ */
+/* $Id: simplexml.c,v 1.212 2006/08/06 17:41:39 tony2001 Exp $ */
 
 #ifdef HAVE_CONFIG_H
 #include "config.h"
@@ -195,6 +195,9 @@
 
        if (sxe->iter.type == SXE_ITER_ELEMENT) {
                orgnode = sxe_find_element_by_name(sxe, node, sxe->iter.name 
TSRMLS_CC);
+               if (!orgnode) {
+                       return NULL;
+               }
                node = orgnode->children;
        }
 
@@ -2265,7 +2268,7 @@
 {
        php_info_print_table_start();
        php_info_print_table_header(2, "Simplexml support", "enabled");
-       php_info_print_table_row(2, "Revision", "$Revision: 1.211 $");
+       php_info_print_table_row(2, "Revision", "$Revision: 1.212 $");
        php_info_print_table_row(2, "Schema support",
 #ifdef LIBXML_SCHEMAS_ENABLED
                "enabled");

http://cvs.php.net/viewvc.cgi/php-src/ext/simplexml/tests/bug38347.phpt?view=markup&rev=1.1
Index: php-src/ext/simplexml/tests/bug38347.phpt
+++ php-src/ext/simplexml/tests/bug38347.phpt
--TEST--
Bug #38347 (Segmentation fault when using foreach with an unknown/empty 
SimpleXMLElement)
--SKIPIF--
<?php if (!extension_loaded("simplexml")) print "skip"; ?>
--FILE--
<?php

function iterate($xml)
{
    print_r($xml);
    foreach ($xml->item as $item) {
        echo "This code will crash!";
    }
}

$xmlstr = "<xml><item>Item 1</item><item>Item 2</item></xml>";
$xml = simplexml_load_string($xmlstr);
iterate($xml->unknown);

echo "Done\n";
?>
--EXPECTF--     
SimpleXMLElement Object
(
)

Warning: iterate(): Node no longer exists in %s on line %d
Done
--UEXPECTF--
SimpleXMLElement Object
(
)

Warning: iterate(): Node no longer exists in %s on line %d
Done

-- 
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php