Fixed Bug #42112 (deleting a node produces memory corruption)

add test

diff --git a/ext/libxml/libxml.c b/ext/libxml/libxml.c
index 91adeaddea09cd802c1319159bf1c1d0cd8a2cf7..50a2b4c937356349a3fa84e63344b3de8b3cc0e8 100644 (file)
--- a/ext/libxml/libxml.c
+++ b/ext/libxml/libxml.c
@@ -240,11 +240,14 @@ static void php_libxml_node_free_list(xmlNodePtr node TSRMLS_DC)
                                case XML_ENTITY_REF_NODE:
                                        php_libxml_node_free_list((xmlNodePtr) node->properties TSRMLS_CC);
                                        break;
+                               case XML_ATTRIBUTE_NODE:
+                                       if ((node->doc != NULL) && (((xmlAttrPtr) node)->atype == XML_ATTRIBUTE_ID)) {
+                                               xmlRemoveID(node->doc, (xmlAttrPtr) node);
+                                       }
                                case XML_ATTRIBUTE_DECL:
                                case XML_DTD_NODE:
                                case XML_DOCUMENT_TYPE_NODE:
                                case XML_ENTITY_DECL:
-                               case XML_ATTRIBUTE_NODE:
                                case XML_NAMESPACE_DECL:
                                case XML_TEXT_NODE:
                                        php_libxml_node_free_list(node->children TSRMLS_CC);

diff --git a/ext/libxml/tests/bug42112.phpt b/ext/libxml/tests/bug42112.phpt
new file mode 100644 (file)
index 0000000..b5a3f40
--- /dev/null
+++ b/ext/libxml/tests/bug42112.phpt
@@ -0,0 +1,31 @@
+--TEST--
+Bug #42112 (deleting a node produces memory corruption)
+--SKIPIF--
+<?php if (!extension_loaded('dom')) die('skip'); ?>
+--FILE--
+<?php
+$xml = <<<EOXML
+<root><child xml:id="id1">baz</child></root>
+EOXML;
+
+function remove_node($doc) {
+    $node = $doc->getElementById( 'id1' );
+    print 'Deleting Node: '.$node->nodeName."\n";
+    $node->parentNode->removeChild( $node );
+}
+
+$doc = new DOMDocument();
+$doc->loadXML($xml);
+
+remove_node($doc);
+
+$node = $doc->getElementById( 'id1' );
+if ($node) {
+       print 'Found Node: '.$node->nodeName."\n";
+}
+$root = $doc->documentElement;
+print 'Root Node: '.$root->nodeName."\n";
+?>
+--EXPECT--
+Deleting Node: child
+Root Node: root