From: Rob Richards <rrichards@php.net>
Date: Thu, 27 Oct 2005 23:49:38 +0000 (+0000)
Subject: fix crash setting attr from foreign doc (throws exception)
X-Git-Tag: RELEASE_2_0_1~143
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=a953be4fff04b16bf407999664cfd9107005cd3d;p=php

fix crash setting attr from foreign doc (throws exception)
add test
---

diff --git a/ext/dom/element.c b/ext/dom/element.c
index 68e63c061c..11d2304e06 100644
--- a/ext/dom/element.c
+++ b/ext/dom/element.c
@@ -368,6 +368,11 @@ PHP_FUNCTION(dom_element_set_attribute_node)
 		RETURN_FALSE;
 	}
 
+	if (!(attrp->doc == NULL || attrp->doc == nodep->doc)) {
+		php_dom_throw_error(WRONG_DOCUMENT_ERR, dom_get_strict_error(intern->document) TSRMLS_CC);
+		RETURN_FALSE;
+	}
+
 	existattrp = xmlHasProp(nodep, attrp->name);
 	if (existattrp != NULL && existattrp->type != XML_ATTRIBUTE_DECL) {
 		if ((oldobj = php_dom_object_get_data((xmlNodePtr) existattrp)) != NULL && 
@@ -769,6 +774,11 @@ PHP_FUNCTION(dom_element_set_attribute_node_ns)
 		RETURN_FALSE;
 	}
 
+	if (!(attrp->doc == NULL || attrp->doc == nodep->doc)) {
+		php_dom_throw_error(WRONG_DOCUMENT_ERR, dom_get_strict_error(intern->document) TSRMLS_CC);
+		RETURN_FALSE;
+	}
+
     nsp = attrp->ns;
     if (nsp != NULL) {
         existattrp = xmlHasNsProp(nodep, nsp->href, attrp->name);
diff --git a/ext/dom/tests/dom_set_attr_node.phpt b/ext/dom/tests/dom_set_attr_node.phpt
new file mode 100644
index 0000000000..ef56dbec6d
--- /dev/null
+++ b/ext/dom/tests/dom_set_attr_node.phpt
@@ -0,0 +1,102 @@
+--TEST--
+Test: setAttributeNode()
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+
+$xml = <<<HERE
+<?xml version="1.0" ?>
+<root a="b" />
+HERE;
+
+$xml2 = <<<HERE
+<?xml version="1.0" ?>
+<doc2 />
+HERE;
+
+$dom = new DOMDocument();
+$dom->loadXML($xml);
+$root = $dom->documentElement;
+$attr = $root->getAttributeNode('a');
+
+$dom2 = new DOMDocument();
+$dom2->loadXML($xml2);
+$root2 = $dom2->documentElement;
+try {
+   $root2->setAttributeNode($attr);
+} catch (domexception $e) {
+    var_dump($e);
+} 
+
+?>
+--EXPECTF--
+object(DOMException)#%d (6) {
+  ["message":protected]=>
+  string(20) "Wrong Document Error"
+  ["string":"Exception":private]=>
+  string(0) ""
+  ["file":protected]=>
+  string(%d) "%sdom_set_attr_node.php"
+  ["line":protected]=>
+  int(22)
+  ["trace":"Exception":private]=>
+  array(1) {
+    [0]=>
+    array(6) {
+      ["file"]=>
+      string(%d) "%sdom_set_attr_node.php"
+      ["line"]=>
+      int(22)
+      ["function"]=>
+      string(16) "setAttributeNode"
+      ["class"]=>
+      string(10) "DOMElement"
+      ["type"]=>
+      string(2) "->"
+      ["args"]=>
+      array(1) {
+        [0]=>
+        object(DOMAttr)#%d (0) {
+        }
+      }
+    }
+  }
+  ["code"]=>
+  int(4)
+}
+--UEXPECTF--
+object(DOMException)#%d (6) {
+  [u"message":protected]=>
+  unicode(20) "Wrong Document Error"
+  [u"string":u"Exception":private]=>
+  unicode(0) ""
+  [u"file":protected]=>
+  unicode(%d) "%sdom_set_attr_node.php"
+  [u"line":protected]=>
+  int(22)
+  [u"trace":u"Exception":private]=>
+  array(1) {
+    [0]=>
+    array(6) {
+      [u"file"]=>
+      unicode(%d) "%sdom_set_attr_node.php"
+      [u"line"]=>
+      int(22)
+      [u"function"]=>
+      unicode(16) "setAttributeNode"
+      [u"class"]=>
+      unicode(10) "DOMElement"
+      [u"type"]=>
+      unicode(2) "->"
+      [u"args"]=>
+      array(1) {
+        [0]=>
+        object(DOMAttr)#%d (0) {
+        }
+      }
+    }
+  }
+  ["code"]=>
+  int(4)
+}
\ No newline at end of file