From: gallien at teisger dot com
Operating system: SuSE Linux 9.2
PHP version: 6CVS-2006-08-05 (snap)
PHP Bug Type: SimpleXML related
Bug description: Segmentation fault by calling foreach with an unknown/empty
SimpleXMLElement.
Description:
------------
I am using PHP CLI on SuSE Linux 9.2 and the following code produces a
segmentation fault calling the php file with "/usr/bin/php test.php". The
element "$xml->unknown" used for calling the function iterate() does not
really exist.
It seems the function "sxe_find_element_by_name()" in "simplexml.c"
returns a null pointer for "orgnode" and then "orgnode->children" is a
very dangerous access (see backtrace).
configure: ./configure --prefix=/usr/local/php5
--with-apxs2=/usr/sbin/apxs2 --with-libxml-dir=/usr/lib --with-zlib
--with-zlib-dir=/usr/lib --with-mysql=/usr/bin/mysql --with-gd
--enable-sockets --with-gettext=/usr/bin/gettext --with-jpeg-dir=/usr/bin
--with-png-dir=/usr/lib --with-freetype-dir=/usr/lib
Reproduce code:
---------------
<?php
function iterate($xml)
{
print_r($xml);
foreach ($xml->item as $item) {
echo "This code will crash!";
}
}
$xmlstr = "<xml><item>Item 1</item><item>Item 2</item></xml>";
$xml = simplexml_load_string($xmlstr);
iterate($xml->unknown);
?>
Expected result:
----------------
Error or warning but not a segmentation fault.
Actual result:
--------------
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1077766880 (LWP 10600)]
sxe_property_get_adr (object=0x403e2458, member=0x403e3dfc)
at /usr/local/src/php5.2-200608051230/ext/simplexml/simplexml.c:198
198 node = orgnode->children;
(gdb) bt
#0 sxe_property_get_adr (object=0x403e2458, member=0x403e3dfc)
at /usr/local/src/php5.2-200608051230/ext/simplexml/simplexml.c:198
#1 0x08247209 in zend_fetch_property_address (result=0xbfffcd90,
container_ptr=0x403e4474,
prop_ptr=0x403e3dfc, type=1) at
/usr/local/src/php5.2-200608051230/Zend/zend_execute.c:1264
#2 0x0824ac88 in ZEND_FETCH_OBJ_W_SPEC_CV_CONST_HANDLER
(execute_data=0xbfffcdf0)
at /usr/local/src/php5.2-200608051230/Zend/zend_execute.c:271
#3 0x08278239 in execute (op_array=0x843c810) at zend_vm_execute.h:92
#4 0x0822dde9 in zend_do_fcall_common_helper_SPEC
(execute_data=0xbfffcf40)
at zend_vm_execute.h:234
#5 0x08278239 in execute (op_array=0x403e2908) at zend_vm_execute.h:92
#6 0x0821373f in zend_execute_scripts (type=8, retval=0x0, file_count=3)
at /usr/local/src/php5.2-200608051230/Zend/zend.c:1095
#7 0x081dbab9 in php_execute_script (primary_file=0xbffff410)
at /usr/local/src/php5.2-200608051230/main/main.c:1759
#8 0x08279650 in main (argc=2, argv=0xbffff4e4)
at /usr/local/src/php5.2-200608051230/sapi/cli/php_cli.c:1097
--
Edit bug report at http://bugs.php.net/?id=38347&edit=1
--
Try a CVS snapshot (PHP 4.4):
http://bugs.php.net/fix.php?id=38347&r=trysnapshot44
Try a CVS snapshot (PHP 5.2):
http://bugs.php.net/fix.php?id=38347&r=trysnapshot52
Try a CVS snapshot (PHP 6.0):
http://bugs.php.net/fix.php?id=38347&r=trysnapshot60
Fixed in CVS: http://bugs.php.net/fix.php?id=38347&r=fixedcvs
Fixed in release:
http://bugs.php.net/fix.php?id=38347&r=alreadyfixed
Need backtrace: http://bugs.php.net/fix.php?id=38347&r=needtrace
Need Reproduce Script: http://bugs.php.net/fix.php?id=38347&r=needscript
Try newer version: http://bugs.php.net/fix.php?id=38347&r=oldversion
Not developer issue: http://bugs.php.net/fix.php?id=38347&r=support
Expected behavior: http://bugs.php.net/fix.php?id=38347&r=notwrong
Not enough info:
http://bugs.php.net/fix.php?id=38347&r=notenoughinfo
Submitted twice:
http://bugs.php.net/fix.php?id=38347&r=submittedtwice
register_globals: http://bugs.php.net/fix.php?id=38347&r=globals
PHP 3 support discontinued: http://bugs.php.net/fix.php?id=38347&r=php3
Daylight Savings: http://bugs.php.net/fix.php?id=38347&r=dst
IIS Stability: http://bugs.php.net/fix.php?id=38347&r=isapi
Install GNU Sed: http://bugs.php.net/fix.php?id=38347&r=gnused
Floating point limitations: http://bugs.php.net/fix.php?id=38347&r=float
No Zend Extensions: http://bugs.php.net/fix.php?id=38347&r=nozend
MySQL Configuration Error: http://bugs.php.net/fix.php?id=38347&r=mysqlcfg
