diff options
| author | Christoph M. Becker <cmb@php.net> | 2016-07-15 00:57:36 +0200 |
|---|---|---|
| committer | Christoph M. Becker <cmb@php.net> | 2016-07-15 01:08:08 +0200 |
| commit | a4aa4f9772a6c30f69db8560cde1f5fe4545b174 (patch) | |
| tree | ad0097c2d52ec1f54a9fb651916d7a750bcc4619 /ext/dom | |
| parent | 1c84b55adea936b065a20102202bea3d1d243225 (diff) | |
| download | php-git-a4aa4f9772a6c30f69db8560cde1f5fe4545b174.tar.gz | |
Fix bug #66502: DOM document dangling reference
When we decrement the refcount of a node's document, we state that we
won't need it anymore. Therefore we can *always* set the pointer to the
document to NULL, what avoids invalid memory accesses for some edge cases
as demonstrated with the PHPT.
Original patch provided by Sean Heelan.
Diffstat (limited to 'ext/dom')
| -rw-r--r-- | ext/dom/tests/bug66502.phpt | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/ext/dom/tests/bug66502.phpt b/ext/dom/tests/bug66502.phpt new file mode 100644 index 0000000000..5b35b41e93 --- /dev/null +++ b/ext/dom/tests/bug66502.phpt @@ -0,0 +1,20 @@ +--TEST-- +Bug #66502 (DOM document dangling reference) +--SKIPIF-- +<?php +if (!extension_loaded('dom')) die('skip requires ext/dom'); +?> +--FILE-- +<?php +$dom = new DOMDocument('1.0', 'UTF-8'); +$element = $dom->appendChild(new DOMElement('root')); +$comment = new DOMComment("Comment 0"); +$comment = $element->appendChild($comment); + +$comment->__construct("Comment 1"); +$comment->__construct("Comment 2"); +$comment->__construct("Comment 3"); +echo 'DONE', PHP_EOL; +?> +--EXPECT-- +DONE
\ No newline at end of file |