diff options
| author | Christoph M. Becker <cmbecker69@gmx.de> | 2019-05-17 13:31:18 +0200 |
|---|---|---|
| committer | Christoph M. Becker <cmbecker69@gmx.de> | 2019-05-17 13:31:18 +0200 |
| commit | e246dea9fe4d679f20de298c753d9ad083dbad68 (patch) | |
| tree | 3cf94c2cf2c1336fec08d0bfdaf9d1d4eb5b4e22 | |
| parent | 35353dc49a73a58c17c7896c4c4c3997ef2c007d (diff) | |
| download | php-git-e246dea9fe4d679f20de298c753d9ad083dbad68.tar.gz | |
Fix #78025: segfault when accessing properties of DOMDocumentType
Instead of following the NULL pointer, we return an empty string.
| -rw-r--r-- | NEWS | 4 | ||||
| -rw-r--r-- | ext/dom/documenttype.c | 2 | ||||
| -rw-r--r-- | ext/dom/tests/bug78025.phpt | 18 |
3 files changed, 23 insertions, 1 deletions
@@ -6,6 +6,10 @@ PHP NEWS . Fixed bug #76980 (Interface gets skipped if autoloader throws an exception). (Nikita) +- DOM: + . Fixed bug #78025 (segfault when accessing properties of DOMDocumentType). + (cmb) + 30 May 2019, PHP 7.2.19 - FPM: diff --git a/ext/dom/documenttype.c b/ext/dom/documenttype.c index 661d23d1c9..d261d267fc 100644 --- a/ext/dom/documenttype.c +++ b/ext/dom/documenttype.c @@ -52,7 +52,7 @@ int dom_documenttype_name_read(dom_object *obj, zval *retval) return FAILURE; } - ZVAL_STRING(retval, (char *) (dtdptr->name)); + ZVAL_STRING(retval, dtdptr->name ? (char *) (dtdptr->name) : ""); return SUCCESS; } diff --git a/ext/dom/tests/bug78025.phpt b/ext/dom/tests/bug78025.phpt new file mode 100644 index 0000000000..0a12d9f42f --- /dev/null +++ b/ext/dom/tests/bug78025.phpt @@ -0,0 +1,18 @@ +--TEST-- +Bug #78025 (segfault when accessing properties of DOMDocumentType) +--SKIPIF-- +<?php +if (!extension_loaded('dom')) die('skip dom extension not available'); +?> +--FILE-- +<?php +$htm = "<!DOCTYPE><html></html>"; +$dom = new DOMDocument; +$dom->loadHTML($htm); +var_dump($dom->doctype->name); +?> +===DONE=== +--EXPECTF-- +Warning: DOMDocument::loadHTML(): htmlParseDocTypeDecl : no DOCTYPE name ! in Entity, line: 1 in %s on line %d +string(0) "" +===DONE=== |