xref: /php-src/ext/dom/tests/bug80927.phpt (revision bb092ab4) 
1--TEST--
2Bug #80927 (Removing documentElement after creating attribute node: possible use-after-free)
3--EXTENSIONS--
4dom
5--FILE--
6<?php
7
8function test1() {
9    $dom = new DOMDocument();
10    $dom->appendChild($dom->createElement("html"));
11    $a = $dom->createAttributeNS("fake_ns", "test:test");
12    $dom->removeChild($dom->documentElement);
13
14    echo $dom->saveXML();
15
16    var_dump($a->namespaceURI);
17    var_dump($a->prefix);
18}
19
20enum Test2Variation {
21    case REMOVE_DOCUMENT;
22    case REMOVE_CHILD;
23}
24
25function test2(Test2Variation $variation) {
26    $dom = new DOMDocument();
27    $dom->appendChild($dom->createElement("html"));
28    $a = $dom->createAttributeNS("fake_ns", "test:test");
29
30    $foo = $dom->appendChild($dom->createElement('foo'));
31    $foo->appendChild($dom->documentElement);
32
33    unset($foo);
34
35    match ($variation) {
36        Test2Variation::REMOVE_DOCUMENT => $dom->documentElement->remove(),
37        Test2Variation::REMOVE_CHILD => $dom->documentElement->firstElementChild->remove(),
38    };
39
40    echo $dom->saveXML();
41
42    var_dump($a->namespaceURI);
43    var_dump($a->prefix);
44}
45
46function test3() {
47    $dom = new DOMDocument();
48    $dom->appendChild($dom->createElement('html'));
49    $foobar = $dom->documentElement->appendChild($dom->createElementNS('some:ns', 'foo:bar'));
50    $foobar2 = $foobar->appendChild($dom->createElementNS('some:ns', 'foo:bar2'));
51    $foobar->remove();
52    unset($foobar);
53    $dom->documentElement->appendChild($foobar2);
54
55    echo $dom->saveXML();
56
57    var_dump($foobar2->namespaceURI);
58    var_dump($foobar2->prefix);
59}
60
61echo "--- Remove namespace declarator for attribute, root ---\n";
62test1();
63echo "--- Remove namespace declarator for attribute, moved root ---\n";
64test2(Test2Variation::REMOVE_DOCUMENT);
65echo "--- Remove namespace declarator for attribute, moved root child ---\n";
66test2(Test2Variation::REMOVE_CHILD);
67echo "--- Remove namespace declarator for element ---\n";
68test3();
69
70?>
71--EXPECT--
72--- Remove namespace declarator for attribute, root ---
73<?xml version="1.0"?>
74string(7) "fake_ns"
75string(4) "test"
76--- Remove namespace declarator for attribute, moved root ---
77<?xml version="1.0"?>
78string(7) "fake_ns"
79string(4) "test"
80--- Remove namespace declarator for attribute, moved root child ---
81<?xml version="1.0"?>
82<foo/>
83string(7) "fake_ns"
84string(4) "test"
85--- Remove namespace declarator for element ---
86<?xml version="1.0"?>
87<html><foo:bar2 xmlns:foo="some:ns"/></html>
88string(7) "some:ns"
89string(3) "foo"
90