MFH: Fixed #24609 (segfault when using replace node across different docs)

Patch by: Rob Richards

# This patch somehow did not make it into 4.3.X, so on Rob's request in am
# MFHing it in.

diff --git a/ext/domxml/php_domxml.c b/ext/domxml/php_domxml.c
index b2d132aec2e97f8b4bff3267d299dbbf8a3747c1..3a33492224ff75bb8c7b2606ee8d345b1526c78e 100644 (file)
--- a/ext/domxml/php_domxml.c
+++ b/ext/domxml/php_domxml.c
@@ -2384,6 +2384,7 @@ PHP_FUNCTION(domxml_node_replace_node)
 {
        zval *id, *rv = NULL, *node;
        xmlNodePtr repnode, nodep, old_repnode;
+       xmlDocPtr tmpdoc;
        int ret;
 
        DOMXML_GET_THIS_OBJ(nodep, id, le_domxmlnodep);
@@ -2394,8 +2395,18 @@ PHP_FUNCTION(domxml_node_replace_node)
 
        DOMXML_GET_OBJ(repnode, node, le_domxmlnodep);
 
+       tmpdoc = repnode->doc;
+
        old_repnode = xmlReplaceNode(nodep, repnode);
 
+       /* ReplaceNode will change the doc for only the first node 
+       so check if doc was changed */
+       if (tmpdoc != repnode->doc) {
+               /* Set doc back to old doc otherwise libxml wont change all sub nodes */
+               repnode->doc = tmpdoc;
+               xmlSetTreeDoc(repnode, old_repnode->doc);
+       }
+
        DOMXML_RET_OBJ(rv, old_repnode, &ret);
 }
 /* }}} */