ID: 38347
Comment by: judas dot iscariote at gmail dot com
Reported By: gallien at teisger dot com
Status: Open
Bug Type: SimpleXML related
Operating System: SuSE Linux 9.2
PHP Version: 6CVS-2006-08-05 (snap)
New Comment:
reproducible in current 5_2 too.
Previous Comments:
------------------------------------------------------------------------
[2006-08-05 15:25:41] gallien at teisger dot com
Description:
------------
I am using PHP CLI on SuSE Linux 9.2 and the following code produces a
segmentation fault calling the php file with "/usr/bin/php test.php".
The element "$xml->unknown" used for calling the function iterate()
does not really exist.
It seems the function "sxe_find_element_by_name()" in "simplexml.c"
returns a null pointer for "orgnode" and then "orgnode->children" is a
very dangerous access (see backtrace).
configure: ./configure --prefix=/usr/local/php5
--with-apxs2=/usr/sbin/apxs2 --with-libxml-dir=/usr/lib --with-zlib
--with-zlib-dir=/usr/lib --with-mysql=/usr/bin/mysql --with-gd
--enable-sockets --with-gettext=/usr/bin/gettext
--with-jpeg-dir=/usr/bin --with-png-dir=/usr/lib
--with-freetype-dir=/usr/lib
Reproduce code:
---------------
<?php
function iterate($xml)
{
print_r($xml);
foreach ($xml->item as $item) {
echo "This code will crash!";
}
}
$xmlstr = "<xml><item>Item 1</item><item>Item 2</item></xml>";
$xml = simplexml_load_string($xmlstr);
iterate($xml->unknown);
?>
Expected result:
----------------
Error or warning but not a segmentation fault.
Actual result:
--------------
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1077766880 (LWP 10600)]
sxe_property_get_adr (object=0x403e2458, member=0x403e3dfc)
at
/usr/local/src/php5.2-200608051230/ext/simplexml/simplexml.c:198
198 node = orgnode->children;
(gdb) bt
#0 sxe_property_get_adr (object=0x403e2458, member=0x403e3dfc)
at
/usr/local/src/php5.2-200608051230/ext/simplexml/simplexml.c:198
#1 0x08247209 in zend_fetch_property_address (result=0xbfffcd90,
container_ptr=0x403e4474,
prop_ptr=0x403e3dfc, type=1) at
/usr/local/src/php5.2-200608051230/Zend/zend_execute.c:1264
#2 0x0824ac88 in ZEND_FETCH_OBJ_W_SPEC_CV_CONST_HANDLER
(execute_data=0xbfffcdf0)
at /usr/local/src/php5.2-200608051230/Zend/zend_execute.c:271
#3 0x08278239 in execute (op_array=0x843c810) at zend_vm_execute.h:92
#4 0x0822dde9 in zend_do_fcall_common_helper_SPEC
(execute_data=0xbfffcf40)
at zend_vm_execute.h:234
#5 0x08278239 in execute (op_array=0x403e2908) at
zend_vm_execute.h:92
#6 0x0821373f in zend_execute_scripts (type=8, retval=0x0,
file_count=3)
at /usr/local/src/php5.2-200608051230/Zend/zend.c:1095
#7 0x081dbab9 in php_execute_script (primary_file=0xbffff410)
at /usr/local/src/php5.2-200608051230/main/main.c:1759
#8 0x08279650 in main (argc=2, argv=0xbffff4e4)
at /usr/local/src/php5.2-200608051230/sapi/cli/php_cli.c:1097
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=38347&edit=1
