archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-18 23:18:56 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

MFB: Fixed Bug #42112 (deleting a node produces memory corruption)

Browse source 
add test
This commit is contained in:
Rob Richards 2007-07-28 08:34:09 +00:00
parent e9af174f6d
commit 7fac5158d7
2 changed files with 35 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
ext/libxml/libxml.c
View file

@ -240,11 +240,14 @@ static void php_libxml_node_free_list(xmlNodePtr node TSRMLS_DC)
case XML_ENTITY_REF_NODE:
php_libxml_node_free_list((xmlNodePtr) node->properties TSRMLS_CC);
break;
case XML_ATTRIBUTE_NODE:
if ((node->doc != NULL) && (((xmlAttrPtr) node)->atype == XML_ATTRIBUTE_ID)) {
xmlRemoveID(node->doc, (xmlAttrPtr) node);
}
case XML_ATTRIBUTE_DECL:
case XML_DTD_NODE:
case XML_DOCUMENT_TYPE_NODE:
case XML_ENTITY_DECL:
case XML_ATTRIBUTE_NODE:
case XML_NAMESPACE_DECL:
case XML_TEXT_NODE:
php_libxml_node_free_list(node->children TSRMLS_CC);

31
ext/libxml/tests/bug42112.phpt Normal file
View file

@ -0,0 +1,31 @@
--TEST--
Bug #42112 (deleting a node produces memory corruption)
--SKIPIF--
<?php if (!extension_loaded('dom')) die('skip'); ?>
--FILE--
<?php
$xml = <<<EOXML
<root><child xml:id="id1">baz</child></root>
EOXML;
function remove_node($doc) {
$node = $doc->getElementById( 'id1' );
print 'Deleting Node: '.$node->nodeName."\n";
$node->parentNode->removeChild( $node );
}
$doc = new DOMDocument();
$doc->loadXML($xml);
remove_node($doc);
$node = $doc->getElementById( 'id1' );
if ($node) {
print 'Found Node: '.$node->nodeName."\n";
}
$root = $doc->documentElement;
print 'Root Node: '.$root->nodeName."\n";
?>
--EXPECT--
Deleting Node: child
Root Node: root