[2006-08-05 15:25 UTC] gallien at teisger dot com

Description:
------------
I am using PHP CLI on SuSE Linux 9.2 and the following code produces a segmentation fault calling the php file with "/usr/bin/php test.php". The element "$xml->unknown" used for calling the function iterate() does not really exist.

It seems the function "sxe_find_element_by_name()" in "simplexml.c" returns a null pointer for "orgnode" and then "orgnode->children" is a very dangerous access (see backtrace).

configure: ./configure --prefix=/usr/local/php5 --with-apxs2=/usr/sbin/apxs2 --with-libxml-dir=/usr/lib --with-zlib --with-zlib-dir=/usr/lib --with-mysql=/usr/bin/mysql --with-gd --enable-sockets --with-gettext=/usr/bin/gettext --with-jpeg-dir=/usr/bin --with-png-dir=/usr/lib --with-freetype-dir=/usr/lib

Reproduce code:
---------------
<?php

function iterate($xml)
{
    print_r($xml);
    foreach ($xml->item as $item) {
        echo "This code will crash!";
    }
}

$xmlstr = "<xml><item>Item 1</item><item>Item 2</item></xml>";
$xml = simplexml_load_string($xmlstr);
iterate($xml->unknown);

?>


Expected result:
----------------
Error or warning but not a segmentation fault.

Actual result:
--------------
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1077766880 (LWP 10600)]
sxe_property_get_adr (object=0x403e2458, member=0x403e3dfc)
    at /usr/local/src/php5.2-200608051230/ext/simplexml/simplexml.c:198
198                     node = orgnode->children;
(gdb) bt
#0  sxe_property_get_adr (object=0x403e2458, member=0x403e3dfc)
    at /usr/local/src/php5.2-200608051230/ext/simplexml/simplexml.c:198
#1  0x08247209 in zend_fetch_property_address (result=0xbfffcd90, container_ptr=0x403e4474,
    prop_ptr=0x403e3dfc, type=1) at /usr/local/src/php5.2-200608051230/Zend/zend_execute.c:1264
#2  0x0824ac88 in ZEND_FETCH_OBJ_W_SPEC_CV_CONST_HANDLER (execute_data=0xbfffcdf0)
    at /usr/local/src/php5.2-200608051230/Zend/zend_execute.c:271
#3  0x08278239 in execute (op_array=0x843c810) at zend_vm_execute.h:92
#4  0x0822dde9 in zend_do_fcall_common_helper_SPEC (execute_data=0xbfffcf40)
    at zend_vm_execute.h:234
#5  0x08278239 in execute (op_array=0x403e2908) at zend_vm_execute.h:92
#6  0x0821373f in zend_execute_scripts (type=8, retval=0x0, file_count=3)
    at /usr/local/src/php5.2-200608051230/Zend/zend.c:1095
#7  0x081dbab9 in php_execute_script (primary_file=0xbffff410)
    at /usr/local/src/php5.2-200608051230/main/main.c:1759
#8  0x08279650 in main (argc=2, argv=0xbffff4e4)
    at /usr/local/src/php5.2-200608051230/sapi/cli/php_cli.c:1097