From: Markus Fischer <mfischer@php.net>
Date: Thu, 3 Jan 2002 13:20:04 +0000 (+0000)
Subject: - domxml_node_add_child(): Perform deep copy before adding child to prevent
X-Git-Tag: PRE_ISSET_PATCH~321
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=7f428de3700d7b68aa31f2f0dac75c7ff8406998;p=php

- domxml_node_add_child(): Perform deep copy before adding child to prevent
  double memory freeing.
# I wonder how this could work before.
---

diff --git a/ext/domxml/php_domxml.c b/ext/domxml/php_domxml.c
index 3eccb247a4..405f04fd1d 100644
--- a/ext/domxml/php_domxml.c
+++ b/ext/domxml/php_domxml.c
@@ -1604,7 +1604,7 @@ PHP_FUNCTION(domxml_node_unlink_node)
 PHP_FUNCTION(domxml_node_add_child)
 {
 	zval *id, *rv, *node;
-	xmlNodePtr child, nodep;
+	xmlNodePtr child, nodep, new_child;
 	int ret;
 
 	DOMXML_GET_THIS_OBJ(nodep, id, le_domxmlnodep);
@@ -1615,7 +1615,12 @@ PHP_FUNCTION(domxml_node_add_child)
 
 	DOMXML_GET_OBJ(child, node, le_domxmlnodep);
 
-	child = xmlAddChild(nodep, child);
+	if (NULL == (new_child = xmlCopyNode(child, 1))) {
+		php_error(E_WARNING, "%s() unable to clone node", get_active_function_name(TSRMLS_C));
+		RETURN_FALSE;
+	}
+
+	child = xmlAddChild(nodep, new_child);
 
 	if (NULL == child) {
 		php_error(E_WARNING, "%s() couldn't add child", get_active_function_name(TSRMLS_C));