diff options
| author | Hannes Magnusson <bjori@php.net> | 2011-05-29 11:39:49 +0000 |
|---|---|---|
| committer | Hannes Magnusson <bjori@php.net> | 2011-05-29 11:39:49 +0000 |
| commit | 07bcf1080d38e7b5e927d4d1449984b39918a030 (patch) | |
| tree | 297740a8099b274d30b541f4d4b19efe52786351 | |
| parent | 69a12bfb3f311fd11f964e81f3f00fca4c7cdbf6 (diff) | |
| download | php-git-07bcf1080d38e7b5e927d4d1449984b39918a030.tar.gz | |
Fixed bug #54601 (Removing the doctype node segfaults)
| -rw-r--r-- | NEWS | 1 | ||||
| -rw-r--r-- | ext/dom/tests/bug54601.phpt | 30 | ||||
| -rw-r--r-- | ext/libxml/libxml.c | 2 |
3 files changed, 32 insertions, 1 deletions
@@ -91,6 +91,7 @@ PHP NEWS libraries). (Clint Byrum, Raphael) - libxml extension: + . Fixed bug #54601 (Removing the doctype node segfaults). (Hannes) . Fixed bug #54440 (libxml extension ignores default context). (Gustavo) - mbstring extension: diff --git a/ext/dom/tests/bug54601.phpt b/ext/dom/tests/bug54601.phpt new file mode 100644 index 0000000000..8a2da2dee2 --- /dev/null +++ b/ext/dom/tests/bug54601.phpt @@ -0,0 +1,30 @@ +--TEST-- +Segfault when removing the Doctype node +--SKIPIF-- +<?php require_once('skipif.inc'); ?> +--FILE-- +<?php +$xml = <<< XML +<?xml version='1.0' encoding='utf-8' ?> +<!DOCTYPE set PUBLIC "-//OASIS//DTD DocBook XML V5.0//EN" "http://www.docbook.org/xml/5.0/dtd/docbook.dtd" [ +<!ENTITY foo '<foo>footext</foo>'> +<!ENTITY bar '<bar>bartext</bar>'> +]> +<set>&foo;&bar;</set> +XML; + +$doc = new DOMDocument(); +$doc->loadXML($xml, LIBXML_NOENT); +$n = $doc->doctype; +$doc->removeChild($n); +var_dump($n); +print $doc->saveXML(); +?> +===DONE=== +<?php exit(0); ?> +--EXPECTF-- +object(DOMDocumentType)#%d (0) { +} +<?xml version="1.0" encoding="utf-8"?> +<set><foo>footext</foo><bar>bartext</bar></set> +===DONE=== diff --git a/ext/libxml/libxml.c b/ext/libxml/libxml.c index c9fb2871f3..6888aa5d01 100644 --- a/ext/libxml/libxml.c +++ b/ext/libxml/libxml.c @@ -222,6 +222,7 @@ static void php_libxml_node_free_list(xmlNodePtr node TSRMLS_DC) switch (node->type) { /* Skip property freeing for the following types */ case XML_NOTATION_NODE: + case XML_ENTITY_DECL: break; case XML_ENTITY_REF_NODE: php_libxml_node_free_list((xmlNodePtr) node->properties TSRMLS_CC); @@ -233,7 +234,6 @@ static void php_libxml_node_free_list(xmlNodePtr node TSRMLS_DC) case XML_ATTRIBUTE_DECL: case XML_DTD_NODE: case XML_DOCUMENT_TYPE_NODE: - case XML_ENTITY_DECL: case XML_NAMESPACE_DECL: case XML_TEXT_NODE: php_libxml_node_free_list(node->children TSRMLS_CC); |