From: Rob Richards <rrichards@php.net>
Date: Sat, 28 Jul 2007 08:32:51 +0000 (+0000)
Subject: Fixed Bug #42112 (deleting a node produces memory corruption)
X-Git-Tag: php-5.2.4RC1~36
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=b96a8a79ba090586acab4380b6b28dc41c28c790;p=php

Fixed Bug #42112 (deleting a node produces memory corruption)
add test
---

diff --git a/ext/libxml/libxml.c b/ext/libxml/libxml.c
index 91adeaddea..50a2b4c937 100644
--- a/ext/libxml/libxml.c
+++ b/ext/libxml/libxml.c
@@ -240,11 +240,14 @@ static void php_libxml_node_free_list(xmlNodePtr node TSRMLS_DC)
 				case XML_ENTITY_REF_NODE:
 					php_libxml_node_free_list((xmlNodePtr) node->properties TSRMLS_CC);
 					break;
+				case XML_ATTRIBUTE_NODE:
+    					if ((node->doc != NULL) && (((xmlAttrPtr) node)->atype == XML_ATTRIBUTE_ID)) {
+	    					xmlRemoveID(node->doc, (xmlAttrPtr) node);
+    					}
 				case XML_ATTRIBUTE_DECL:
 				case XML_DTD_NODE:
 				case XML_DOCUMENT_TYPE_NODE:
 				case XML_ENTITY_DECL:
-				case XML_ATTRIBUTE_NODE:
 				case XML_NAMESPACE_DECL:
 				case XML_TEXT_NODE:
 					php_libxml_node_free_list(node->children TSRMLS_CC);
diff --git a/ext/libxml/tests/bug42112.phpt b/ext/libxml/tests/bug42112.phpt
new file mode 100644
index 0000000000..b5a3f40b3e
--- /dev/null
+++ b/ext/libxml/tests/bug42112.phpt
@@ -0,0 +1,31 @@
+--TEST--
+Bug #42112 (deleting a node produces memory corruption)
+--SKIPIF--
+<?php if (!extension_loaded('dom')) die('skip'); ?>
+--FILE--
+<?php
+$xml = <<<EOXML
+<root><child xml:id="id1">baz</child></root>
+EOXML;
+
+function remove_node($doc) {
+    $node = $doc->getElementById( 'id1' );
+    print 'Deleting Node: '.$node->nodeName."\n";
+    $node->parentNode->removeChild( $node );
+}
+
+$doc = new DOMDocument();
+$doc->loadXML($xml);
+
+remove_node($doc);
+
+$node = $doc->getElementById( 'id1' );
+if ($node) {
+	print 'Found Node: '.$node->nodeName."\n";
+}
+$root = $doc->documentElement;
+print 'Root Node: '.$root->nodeName."\n";
+?>
+--EXPECT--
+Deleting Node: child
+Root Node: root