Fixed bug #26384 (crash inside domxslt->process() due to a double free).

diff --git a/NEWS b/NEWS
index ab54bdc1a77f18e070a9fae69af6592e9cee6bc0..1c0ee37b0d01a609b8360f28c612aff9e16c50d1 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,7 @@ PHP 4                                                                      NEWS
 ?? ??? 2003, Version 4.3.5
 - Fixed header handler in NSAPI SAPI module (header->replace was ignored,
   send_default_content_type now sends value from php.ini). (Uwe Schindler)
+- Fixed bug #26384 (crash in domxslt->process()). (Ilia)
 - Fixed bug #26355 (flock() doesn't initialize the wouldblock argument). (Ilia)
 - Fixed bug #26309 (Fixed argument parsing for imageftbbox()). (Ilia)
 - Fixed bug #26285 (escapeshellarg() uses wrong quotes on windows). (Ilia)

diff --git a/ext/domxml/php_domxml.c b/ext/domxml/php_domxml.c
index 224cfb861d6320757cf10b88aa1f680bad59cfe2..a741b50ea825bfc459e78405335a756b036dd3dd 100644 (file)
--- a/ext/domxml/php_domxml.c
+++ b/ext/domxml/php_domxml.c
@@ -729,7 +729,6 @@ static void php_free_xml_doc(zend_rsrc_list_entry *rsrc TSRMLS_DC)
        xmlDoc *doc = (xmlDoc *) rsrc->ptr;
 
        if (doc) {
-               node_list_wrapper_dtor(doc->children, 1 TSRMLS_CC);
                node_wrapper_dtor((xmlNodePtr) doc);
                xmlFreeDoc(doc);
        }