diff options
| author | Tim Toohey <ttoohey@php.net> | 2017-06-03 00:38:02 +0200 |
|---|---|---|
| committer | Nikita Popov <nikita.ppv@gmail.com> | 2017-06-03 00:40:58 +0200 |
| commit | d027bc2addb4f12e0030532933a2c85c07cdb293 (patch) | |
| tree | ab11b67b886480a5f6b7c76b73177aee5569091a /ext/dom | |
| parent | 95c4564f939c916538579ef63602a3cd31941c51 (diff) | |
| download | php-git-d027bc2addb4f12e0030532933a2c85c07cdb293.tar.gz | |
Fixed bug #69373
xmlNodeSetContentLen() calls xmlFreeNode() on node->children. This
causes problems if there are other references around to those children.
Diffstat (limited to 'ext/dom')
| -rw-r--r-- | ext/dom/node.c | 10 | ||||
| -rw-r--r-- | ext/dom/tests/bug69373.phpt | 15 |
2 files changed, 25 insertions, 0 deletions
diff --git a/ext/dom/node.c b/ext/dom/node.c index b4ab9f896a..b4a081ebe9 100644 --- a/ext/dom/node.c +++ b/ext/dom/node.c @@ -337,6 +337,8 @@ int dom_node_node_value_write(dom_object *obj, zval *newval) case XML_ATTRIBUTE_NODE: if (nodep->children) { node_list_unlink(nodep->children); + php_libxml_node_free_list((xmlNodePtr) nodep->children); + nodep->children = NULL; } case XML_TEXT_NODE: case XML_COMMENT_NODE: @@ -854,6 +856,14 @@ int dom_node_text_content_write(dom_object *obj, zval *newval) return FAILURE; } + if (nodep->type == XML_ELEMENT_NODE || nodep->type == XML_ATTRIBUTE_NODE) { + if (nodep->children) { + node_list_unlink(nodep->children); + php_libxml_node_free_list((xmlNodePtr) nodep->children); + nodep->children = NULL; + } + } + str = zval_get_string(newval); /* we have to use xmlNodeAddContent() to get the same behavior as with xmlNewText() */ xmlNodeSetContent(nodep, (xmlChar *) ""); diff --git a/ext/dom/tests/bug69373.phpt b/ext/dom/tests/bug69373.phpt new file mode 100644 index 0000000000..d04ac03983 --- /dev/null +++ b/ext/dom/tests/bug69373.phpt @@ -0,0 +1,15 @@ +--TEST-- +Bug #69373 References to deleted XPath query results +--FILE-- +<?php +$doc = new DOMDocument(); +for( $i=0; $i<20; $i++ ) { + $doc->loadXML("<parent><child /><child /></parent>"); + $xpath = new DOMXpath($doc); + $all = $xpath->query('//*'); + $doc->firstChild->nodeValue = ''; +} +echo 'DONE', PHP_EOL; +?> +--EXPECT-- +DONE |