MFH: fix crash setting attr from foreign doc (throws exception)

add test

diff --git a/ext/dom/element.c b/ext/dom/element.c
index 3aa82fa6ae111d060c55158a5a8061dfef5e9782..601770761312686e3be69fff2d6ffbdf80ba2c24 100644 (file)
--- a/ext/dom/element.c
+++ b/ext/dom/element.c
@@ -368,6 +368,11 @@ PHP_FUNCTION(dom_element_set_attribute_node)
                RETURN_FALSE;
        }
 
+       if (!(attrp->doc == NULL || attrp->doc == nodep->doc)) {
+               php_dom_throw_error(WRONG_DOCUMENT_ERR, dom_get_strict_error(intern->document) TSRMLS_CC);
+               RETURN_FALSE;
+       }
+
        existattrp = xmlHasProp(nodep, attrp->name);
        if (existattrp != NULL && existattrp->type != XML_ATTRIBUTE_DECL) {
                if ((oldobj = php_dom_object_get_data((xmlNodePtr) existattrp)) != NULL && 
@@ -769,6 +774,11 @@ PHP_FUNCTION(dom_element_set_attribute_node_ns)
                RETURN_FALSE;
        }
 
+       if (!(attrp->doc == NULL || attrp->doc == nodep->doc)) {
+               php_dom_throw_error(WRONG_DOCUMENT_ERR, dom_get_strict_error(intern->document) TSRMLS_CC);
+               RETURN_FALSE;
+       }
+
     nsp = attrp->ns;
     if (nsp != NULL) {
         existattrp = xmlHasNsProp(nodep, nsp->href, attrp->name);

diff --git a/ext/dom/tests/dom_set_attr_node.phpt b/ext/dom/tests/dom_set_attr_node.phpt
new file mode 100644 (file)
index 0000000..e87a960
--- /dev/null
+++ b/ext/dom/tests/dom_set_attr_node.phpt
@@ -0,0 +1,67 @@
+--TEST--
+Test: setAttributeNode()
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+
+$xml = <<<HERE
+<?xml version="1.0" ?>
+<root a="b" />
+HERE;
+
+$xml2 = <<<HERE
+<?xml version="1.0" ?>
+<doc2 />
+HERE;
+
+$dom = new DOMDocument();
+$dom->loadXML($xml);
+$root = $dom->documentElement;
+$attr = $root->getAttributeNode('a');
+
+$dom2 = new DOMDocument();
+$dom2->loadXML($xml2);
+$root2 = $dom2->documentElement;
+try {
+   $root2->setAttributeNode($attr);
+} catch (domexception $e) {
+    var_dump($e);
+} 
+
+?>
+--EXPECTF--
+object(DOMException)#%d (6) {
+  ["message:protected"]=>
+  string(20) "Wrong Document Error"
+  ["string:private"]=>
+  string(0) ""
+  ["file:protected"]=>
+  string(%d) "%sdom_set_attr_node.php"
+  ["line:protected"]=>
+  int(22)
+  ["trace:private"]=>
+  array(1) {
+    [0]=>
+    array(6) {
+      ["file"]=>
+      string(%d) "%sdom_set_attr_node.php"
+      ["line"]=>
+      int(22)
+      ["function"]=>
+      string(16) "setAttributeNode"
+      ["class"]=>
+      string(10) "DOMElement"
+      ["type"]=>
+      string(2) "->"
+      ["args"]=>
+      array(1) {
+        [0]=>
+        object(DOMAttr)#%d (0) {
+        }
+      }
+    }
+  }
+  ["code"]=>
+  int(4)
+}
\ No newline at end of file