Fixed bug #70535 (XSLT: free(): invalid pointer)

diff --git a/NEWS b/NEWS
index 88cbaaaeec9eb928bf06cfe64f9cc9e1e528eb9a..b62d85614349e110bef4c3ab812d07e425e6c681 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -18,6 +18,9 @@ PHP                                                                        NEWS
 - XMLRPC
   . Fixed bug #70526 (xmlrpc_set_type returns false on success). (Laruence)
 
+- XSL:
+  . Fixed bug #70535 (XSLT: free(): invalid pointer). (Laruence)
+
 17 Sep 2015, PHP 7.0.0 RC 3
 
 - Core:

diff --git a/ext/libxml/php_libxml.h b/ext/libxml/php_libxml.h
index 6dc9daaeaf7d0fc3c8b42d65ee8cac3a5233c2c5..3d61b6b7e8df1463a284cfc15a3e5c6bef4def20 100644 (file)
--- a/ext/libxml/php_libxml.h
+++ b/ext/libxml/php_libxml.h
@@ -86,7 +86,7 @@ typedef struct _php_libxml_node_object {
 
 
 static inline php_libxml_node_object *php_libxml_node_fetch_object(zend_object *obj) {
-       return (php_libxml_node_object *)((char*)(obj) - XtOffsetOf(php_libxml_node_object, std));
+       return (php_libxml_node_object *)((char*)(obj) - obj->handlers->offset);
 }
 
 #define Z_LIBXML_NODE_P(zv) php_libxml_node_fetch_object(Z_OBJ_P((zv)))

diff --git a/ext/xsl/tests/bug70535.phpt b/ext/xsl/tests/bug70535.phpt
new file mode 100644 (file)
index 0000000..26b4d3c
--- /dev/null
+++ b/ext/xsl/tests/bug70535.phpt
@@ -0,0 +1,22 @@
+--TEST--
+Bug #70535 (XSLT: free(): invalid pointer)
+--SKIPIF--
+<?php
+if (!extension_loaded('xsl')) die("skip Extension XSL is required\n");
+if (!extension_loaded("simplexml")) print "skip simplexml extension is not loaded";
+?>
+--FILE--
+<?php
+
+$xmlInput = simplexml_load_string('<root></root>');
+$xslInput = '<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"><xsl:template match="root"><xsl:text>success</xsl:text></xsl:template></xsl:stylesheet>';
+
+$xsl = new \DomDocument();
+$xsl->loadXML($xslInput);
+$xslt = new \XsltProcessor();
+$xslt->importStylesheet($xsl);
+$xmloutput = $xslt->transformToXml($xmlInput);
+?>
+okey
+--EXPECT--
+okey