tony2001 Sun Aug 6 17:41:39 2006 UTC Added files: /php-src/ext/simplexml/tests bug38347.phpt
Modified files: /php-src/ext/libxml libxml.c /php-src/ext/simplexml simplexml.c Log: fix #38347 (Segmentation fault when using foreach with an unknown/empty SimpleXMLElement) http://cvs.php.net/viewvc.cgi/php-src/ext/libxml/libxml.c?r1=1.50&r2=1.51&diff_format=u Index: php-src/ext/libxml/libxml.c diff -u php-src/ext/libxml/libxml.c:1.50 php-src/ext/libxml/libxml.c:1.51 --- php-src/ext/libxml/libxml.c:1.50 Tue Jul 4 07:34:32 2006 +++ php-src/ext/libxml/libxml.c Sun Aug 6 17:41:39 2006 @@ -17,7 +17,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: libxml.c,v 1.50 2006/07/04 07:34:32 dmitry Exp $ */ +/* $Id: libxml.c,v 1.51 2006/08/06 17:41:39 tony2001 Exp $ */ #define IS_EXT_MODULE @@ -976,8 +976,8 @@ efree(object->document->doc_props); } efree(object->document); + object->document = NULL; } - object->document = NULL; } return ret_refcount; @@ -1035,6 +1035,8 @@ obj_node->_private = NULL; } } + } + if (object != NULL && object->document != NULL) { /* Safe to call as if the resource were freed then doc pointer is NULL */ php_libxml_decrement_doc_ref(object TSRMLS_CC); } http://cvs.php.net/viewvc.cgi/php-src/ext/simplexml/simplexml.c?r1=1.211&r2=1.212&diff_format=u Index: php-src/ext/simplexml/simplexml.c diff -u php-src/ext/simplexml/simplexml.c:1.211 php-src/ext/simplexml/simplexml.c:1.212 --- php-src/ext/simplexml/simplexml.c:1.211 Sun Aug 6 13:27:38 2006 +++ php-src/ext/simplexml/simplexml.c Sun Aug 6 17:41:39 2006 @@ -18,7 +18,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: simplexml.c,v 1.211 2006/08/06 13:27:38 tony2001 Exp $ */ +/* $Id: simplexml.c,v 1.212 2006/08/06 17:41:39 tony2001 Exp $ */ #ifdef HAVE_CONFIG_H #include "config.h" @@ -195,6 +195,9 @@ if (sxe->iter.type == SXE_ITER_ELEMENT) { orgnode = sxe_find_element_by_name(sxe, node, sxe->iter.name TSRMLS_CC); + if (!orgnode) { + return NULL; + } node = orgnode->children; } @@ -2265,7 +2268,7 @@ { php_info_print_table_start(); php_info_print_table_header(2, "Simplexml support", "enabled"); - php_info_print_table_row(2, "Revision", "$Revision: 1.211 $"); + php_info_print_table_row(2, "Revision", "$Revision: 1.212 $"); php_info_print_table_row(2, "Schema support", #ifdef LIBXML_SCHEMAS_ENABLED "enabled"); http://cvs.php.net/viewvc.cgi/php-src/ext/simplexml/tests/bug38347.phpt?view=markup&rev=1.1 Index: php-src/ext/simplexml/tests/bug38347.phpt +++ php-src/ext/simplexml/tests/bug38347.phpt --TEST-- Bug #38347 (Segmentation fault when using foreach with an unknown/empty SimpleXMLElement) --SKIPIF-- <?php if (!extension_loaded("simplexml")) print "skip"; ?> --FILE-- <?php function iterate($xml) { print_r($xml); foreach ($xml->item as $item) { echo "This code will crash!"; } } $xmlstr = "<xml><item>Item 1</item><item>Item 2</item></xml>"; $xml = simplexml_load_string($xmlstr); iterate($xml->unknown); echo "Done\n"; ?> --EXPECTF-- SimpleXMLElement Object ( ) Warning: iterate(): Node no longer exists in %s on line %d Done --UEXPECTF-- SimpleXMLElement Object ( ) Warning: iterate(): Node no longer exists in %s on line %d Done -- PHP CVS Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php