diff options
| author | Rob Richards <rrichards@php.net> | 2008-06-14 11:24:00 +0000 |
|---|---|---|
| committer | Rob Richards <rrichards@php.net> | 2008-06-14 11:24:00 +0000 |
| commit | b3a2fffb83c223b01c7be04d97833ad8f3598c5c (patch) | |
| tree | cff9007d1a3b487a42093be74d765123879f048f | |
| parent | d2f21677d59b843a471d3b08d6d30a743235c284 (diff) | |
| download | php-git-b3a2fffb83c223b01c7be04d97833ad8f3598c5c.tar.gz | |
MFH: fixed bug #45251 (double free or corruption with setAttributeNode())
add test
| -rw-r--r-- | ext/dom/element.c | 8 | ||||
| -rw-r--r-- | ext/dom/tests/bug45251.phpt | 30 |
2 files changed, 38 insertions, 0 deletions
diff --git a/ext/dom/element.c b/ext/dom/element.c index 0e66ad053e..0171496265 100644 --- a/ext/dom/element.c +++ b/ext/dom/element.c @@ -585,6 +585,10 @@ PHP_FUNCTION(dom_element_set_attribute_node) xmlUnlinkNode((xmlNodePtr) existattrp); } + if (attrp->parent != NULL) { + xmlUnlinkNode((xmlNodePtr) attrp); + } + if (attrp->doc == NULL && nodep->doc != NULL) { attrobj->document = intern->document; php_libxml_increment_doc_ref((php_libxml_node_object *)attrobj, NULL TSRMLS_CC); @@ -998,6 +1002,10 @@ PHP_FUNCTION(dom_element_set_attribute_node_ns) xmlUnlinkNode((xmlNodePtr) existattrp); } + if (attrp->parent != NULL) { + xmlUnlinkNode((xmlNodePtr) attrp); + } + if (attrp->doc == NULL && nodep->doc != NULL) { attrobj->document = intern->document; php_libxml_increment_doc_ref((php_libxml_node_object *)attrobj, NULL TSRMLS_CC); diff --git a/ext/dom/tests/bug45251.phpt b/ext/dom/tests/bug45251.phpt new file mode 100644 index 0000000000..652e3b2530 --- /dev/null +++ b/ext/dom/tests/bug45251.phpt @@ -0,0 +1,30 @@ +--TEST-- +Bug #45251 (double free or corruption with setAttributeNode()) +--SKIPIF-- +<?php require_once('skipif.inc'); ?> +--FILE-- +<?php +$doc = new DOMDocument; +$doc->loadXml(<<<EOF +<?xml version="1.0" encoding="utf-8" ?> +<aaa> + <bbb foo="bar"/> +</aaa> +EOF +); + +$xpath = new DOMXPath($doc); + +$bbb = $xpath->query('bbb', $doc->documentElement)->item(0); + +$ccc = $doc->createElement('ccc'); +foreach ($bbb->attributes as $attr) +{ + $ccc->setAttributeNode($attr); +} + +echo $attr->parentNode->localName; + +?> +--EXPECT-- +ccc |