[PHP-CVS] cvs: php-src(PHP_5_2) /ext/dom element.c /ext/dom/tests bug45251.phpt

[Rob Richards]

rrichards               Sat Jun 14 11:24:00 2008 UTC

  Added files:                 (Branch: PHP_5_2)
    /php-src/ext/dom/tests      bug45251.phpt 

  Modified files:              
    /php-src/ext/dom    element.c 
  Log:
  MFH: fixed bug #45251 (double free or corruption with setAttributeNode())
  add test
  
http://cvs.php.net/viewvc.cgi/php-src/ext/dom/element.c?r1=1.36.2.4.2.10&r2=1.36.2.4.2.11&diff_format=u
Index: php-src/ext/dom/element.c
diff -u php-src/ext/dom/element.c:1.36.2.4.2.10 
php-src/ext/dom/element.c:1.36.2.4.2.11
--- php-src/ext/dom/element.c:1.36.2.4.2.10     Mon Feb  4 15:23:11 2008
+++ php-src/ext/dom/element.c   Sat Jun 14 11:24:00 2008
@@ -17,7 +17,7 @@
    +----------------------------------------------------------------------+
 */
 
-/* $Id: element.c,v 1.36.2.4.2.10 2008/02/04 15:23:11 sebastian Exp $ */
+/* $Id: element.c,v 1.36.2.4.2.11 2008/06/14 11:24:00 rrichards Exp $ */
 
 #ifdef HAVE_CONFIG_H
 #include "config.h"
@@ -585,6 +585,10 @@
                xmlUnlinkNode((xmlNodePtr) existattrp);
        }
 
+       if (attrp->parent != NULL) {
+               xmlUnlinkNode((xmlNodePtr) attrp);
+       }
+
        if (attrp->doc == NULL && nodep->doc != NULL) {
                attrobj->document = intern->document;
                php_libxml_increment_doc_ref((php_libxml_node_object *)attrobj, 
NULL TSRMLS_CC);
@@ -998,6 +1002,10 @@
                xmlUnlinkNode((xmlNodePtr) existattrp);
        }
 
+       if (attrp->parent != NULL) {
+               xmlUnlinkNode((xmlNodePtr) attrp);
+       }
+
        if (attrp->doc == NULL && nodep->doc != NULL) {
                attrobj->document = intern->document;
                php_libxml_increment_doc_ref((php_libxml_node_object *)attrobj, 
NULL TSRMLS_CC);

http://cvs.php.net/viewvc.cgi/php-src/ext/dom/tests/bug45251.phpt?view=markup&rev=1.1
Index: php-src/ext/dom/tests/bug45251.phpt
+++ php-src/ext/dom/tests/bug45251.phpt
--TEST--
Bug #45251 (double free or corruption with setAttributeNode())
--SKIPIF--
<?php require_once('skipif.inc'); ?>
--FILE--
<?php
$doc = new DOMDocument;
$doc->loadXml(<<<EOF
<?xml version="1.0" encoding="utf-8" ?>
<aaa>
  <bbb foo="bar"/>
</aaa>
EOF
);

$xpath = new DOMXPath($doc);

$bbb = $xpath->query('bbb', $doc->documentElement)->item(0);

$ccc = $doc->createElement('ccc');
foreach ($bbb->attributes as $attr)
{
  $ccc->setAttributeNode($attr);
}

echo $attr->parentNode->localName;

?>
--EXPECT--
ccc



-- 
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php