fix for bug #18395 (DOMXML crash on removing previously created attributes)

diff --git a/ext/domxml/php_domxml.c b/ext/domxml/php_domxml.c
index fde6fdfd0af14463992ec8bec7f8d4299e7bad14..e3891234072cee41a2af895509a38a39a2d176f5 100644 (file)
--- a/ext/domxml/php_domxml.c
+++ b/ext/domxml/php_domxml.c
@@ -650,6 +650,17 @@ static void php_free_xml_node(zend_rsrc_list_entry *rsrc TSRMLS_DC)
 
 }
 
+static void php_free_xml_attr(zend_rsrc_list_entry *rsrc TSRMLS_DC)
+{
+       xmlNodePtr node = (xmlNodePtr) rsrc->ptr;
+       if (node->parent == NULL) {
+               node_wrapper_dtor(node);
+               xmlFreeProp((xmlAttrPtr) node);
+       } else {
+               node_wrapper_dtor(node);
+       }
+}
+
 
 #if defined(LIBXML_XPATH_ENABLED)
 static void php_free_xpath_context(zend_rsrc_list_entry *rsrc TSRMLS_DC)
@@ -1525,7 +1536,7 @@ PHP_MINIT_FUNCTION(domxml)
         */
        le_domxmlnodep = zend_register_list_destructors_ex(php_free_xml_node, NULL, "domnode", module_number);
        le_domxmlcommentp = zend_register_list_destructors_ex(php_free_xml_node, NULL, "domcomment", module_number);
-       le_domxmlattrp = zend_register_list_destructors_ex(php_free_xml_node, NULL, "domattribute", module_number);
+       le_domxmlattrp = zend_register_list_destructors_ex(php_free_xml_attr, NULL, "domattribute", module_number);
        le_domxmltextp = zend_register_list_destructors_ex(php_free_xml_node, NULL, "domtext", module_number);
        le_domxmlelementp =     zend_register_list_destructors_ex(php_free_xml_node, NULL, "domelement", module_number);
        le_domxmldtdp = zend_register_list_destructors_ex(php_free_xml_node, NULL, "domdtd", module_number);