[PHP-CVS] cvs: php-src /ext/dom element.c /ext/dom/tests bug45251.phpt

[Rob Richards]

rrichards               Sat Jun 14 11:21:47 2008 UTC

  Added files:                 
    /php-src/ext/dom/tests      bug45251.phpt 

  Modified files:              
    /php-src/ext/dom    element.c 
  Log:
  fixed bug #45251 (double free or corruption with setAttributeNode())
  add test
  
http://cvs.php.net/viewvc.cgi/php-src/ext/dom/element.c?r1=1.57&r2=1.58&diff_format=u
Index: php-src/ext/dom/element.c
diff -u php-src/ext/dom/element.c:1.57 php-src/ext/dom/element.c:1.58
--- php-src/ext/dom/element.c:1.57      Thu Apr 17 20:19:52 2008
+++ php-src/ext/dom/element.c   Sat Jun 14 11:21:47 2008
@@ -17,7 +17,7 @@
    +----------------------------------------------------------------------+
 */
 
-/* $Id: element.c,v 1.57 2008/04/17 20:19:52 rrichards Exp $ */
+/* $Id: element.c,v 1.58 2008/06/14 11:21:47 rrichards Exp $ */
 
 #ifdef HAVE_CONFIG_H
 #include "config.h"
@@ -592,6 +592,10 @@
                xmlUnlinkNode((xmlNodePtr) existattrp);
        }
 
+       if (attrp->parent != NULL) {
+               xmlUnlinkNode((xmlNodePtr) attrp);
+       }
+
        if (attrp->doc == NULL && nodep->doc != NULL) {
                attrobj->document = intern->document;
                php_libxml_increment_doc_ref((php_libxml_node_object *)attrobj, 
NULL TSRMLS_CC);
@@ -1012,6 +1016,10 @@
                xmlUnlinkNode((xmlNodePtr) existattrp);
        }
 
+       if (attrp->parent != NULL) {
+               xmlUnlinkNode((xmlNodePtr) attrp);
+       }
+
        if (attrp->doc == NULL && nodep->doc != NULL) {
                attrobj->document = intern->document;
                php_libxml_increment_doc_ref((php_libxml_node_object *)attrobj, 
NULL TSRMLS_CC);

http://cvs.php.net/viewvc.cgi/php-src/ext/dom/tests/bug45251.phpt?view=markup&rev=1.1
Index: php-src/ext/dom/tests/bug45251.phpt
+++ php-src/ext/dom/tests/bug45251.phpt
--TEST--
Bug #45251 (double free or corruption with setAttributeNode())
--SKIPIF--
<?php require_once('skipif.inc'); ?>
--FILE--
<?php
$doc = new DOMDocument;
$doc->loadXml(<<<EOF
<?xml version="1.0" encoding="utf-8" ?>
<aaa>
  <bbb foo="bar"/>
</aaa>
EOF
);

$xpath = new DOMXPath($doc);

$bbb = $xpath->query('bbb', $doc->documentElement)->item(0);

$ccc = $doc->createElement('ccc');
foreach ($bbb->attributes as $attr)
{
  $ccc->setAttributeNode($attr);
}

echo $attr->parentNode->localName;

?>
--EXPECT--
ccc



-- 
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php