Skip to content

Commit e309fd8

Browse files
committed
Fix lifetime issue with getAttributeNodeNS()
It's the same issue that I fixed previously in phpGH-11402, but in a different place. Closes phpGH-11422.
1 parent f2d673f commit e309fd8

File tree

3 files changed

+25
-16
lines changed

3 files changed

+25
-16
lines changed

NEWS

+1
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ PHP NEWS
3030
. Fixed bug #70359 (print_r() on DOMAttr causes Segfault in
3131
php_libxml_node_free_list()). (nielsdos)
3232
. Fixed bug #78577 (Crash in DOMNameSpace debug info handlers). (nielsdos)
33+
. Fix lifetime issue with getAttributeNodeNS(). (nielsdos)
3334

3435
- Opcache:
3536
. Fix allocation loop in zend_shared_alloc_startup(). (nielsdos)

ext/dom/element.c

+4-16
Original file line numberDiff line numberDiff line change
@@ -787,7 +787,7 @@ Since: DOM Level 2
787787
PHP_METHOD(DOMElement, getAttributeNodeNS)
788788
{
789789
zval *id;
790-
xmlNodePtr elemp, fakeAttrp;
790+
xmlNodePtr elemp;
791791
xmlAttrPtr attrp;
792792
dom_object *intern;
793793
size_t uri_len, name_len;
@@ -808,21 +808,9 @@ PHP_METHOD(DOMElement, getAttributeNodeNS)
808808
xmlNsPtr nsptr;
809809
nsptr = dom_get_nsdecl(elemp, (xmlChar *)name);
810810
if (nsptr != NULL) {
811-
xmlNsPtr curns;
812-
curns = xmlNewNs(NULL, nsptr->href, NULL);
813-
if (nsptr->prefix) {
814-
curns->prefix = xmlStrdup((xmlChar *) nsptr->prefix);
815-
}
816-
if (nsptr->prefix) {
817-
fakeAttrp = xmlNewDocNode(elemp->doc, NULL, (xmlChar *) nsptr->prefix, nsptr->href);
818-
} else {
819-
fakeAttrp = xmlNewDocNode(elemp->doc, NULL, (xmlChar *)"xmlns", nsptr->href);
820-
}
821-
fakeAttrp->type = XML_NAMESPACE_DECL;
822-
fakeAttrp->parent = elemp;
823-
fakeAttrp->ns = curns;
824-
825-
DOM_RET_OBJ(fakeAttrp, &ret, intern);
811+
/* Keep parent alive, because we're a fake child. */
812+
GC_ADDREF(&intern->std);
813+
(void) php_dom_create_fake_namespace_decl(elemp, nsptr, return_value, intern);
826814
} else {
827815
RETURN_NULL();
828816
}
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
--TEST--
2+
Lifetime issue with parentNode on getAttributeNodeNS()
3+
--EXTENSIONS--
4+
dom
5+
--FILE--
6+
<?php
7+
$xmlString = '<?xml version="1.0" encoding="utf-8" ?>
8+
<root xmlns="http://ns" xmlns:ns2="http://ns2">
9+
<ns2:child />
10+
</root>';
11+
12+
$xml=new DOMDocument();
13+
$xml->loadXML($xmlString);
14+
$ns2 = $xml->documentElement->getAttributeNodeNS("http://www.w3.org/2000/xmlns/", "ns2");
15+
$ns2->parentNode->remove();
16+
var_dump($ns2->parentNode->localName);
17+
18+
?>
19+
--EXPECT--
20+
string(4) "root"

0 commit comments

Comments
 (0)