fix bug #38454 (warning upon disabling handler via xml_set_element_handler)

fix bug #38427 (unicode causes xml_parser to misbehave)
add test

2 files changed, 95 insertions, 0 deletions

diff --git a/ext/xml/tests/xml011.phpt b/ext/xml/tests/xml011.phpt
new file mode 100644
index 0000000000..9c4cfca8f1
--- /dev/null
+++ b/ext/xml/tests/xml011.phpt
@@ -0,0 +1,71 @@
+--TEST--
+XML Parser test: concat character data and set empty handlers
+--SKIPIF--
+<?php
+require_once("skipif.inc");
+?>
+--FILE--
+<?php
+function start_elem($parser,$name,$attribs) {
+   echo "<$name>";
+}
+function end_elem()
+{
+   echo "</$name>";
+}
+
+$xml = '<text>start<b /> This &amp; that</text>';
+
+$parser = xml_parser_create();
+xml_parse_into_struct($parser, $xml, $vals, $index);
+print_r($vals);
+xml_parser_free($parser);
+
+echo "\nChange to empty end handler\n";
+$parser = xml_parser_create();
+xml_parser_set_option($parser,XML_OPTION_CASE_FOLDING,0);
+xml_set_element_handler($parser,'start_elem','end_elem');
+xml_set_element_handler($parser,'start_elem',NULL);
+xml_parse($parser, $xml, TRUE);
+
+xml_parser_free($parser);
+echo "\nDone\n";
+?>
+--EXPECT--
+Array
+(
+    [0] => Array
+        (
+            [tag] => TEXT
+            [type] => open
+            [level] => 1
+            [value] => start
+        )
+
+    [1] => Array
+        (
+            [tag] => B
+            [type] => complete
+            [level] => 2
+        )
+
+    [2] => Array
+        (
+            [tag] => TEXT
+            [value] =>  This & that
+            [type] => cdata
+            [level] => 1
+        )
+
+    [3] => Array
+        (
+            [tag] => TEXT
+            [type] => close
+            [level] => 1
+        )
+
+)
+
+Change to empty end handler
+<text><b>
+Done
diff --git a/ext/xml/xml.c b/ext/xml/xml.c
index 789ec0cf5b..9c8d842176 100644
--- a/ext/xml/xml.c
+++ b/ext/xml/xml.c
@@ -380,7 +380,12 @@ static void xml_set_handler(zval **handler, zval **data)
 
 	/* IS_ARRAY might indicate that we're using array($obj, 'method') syntax */
 	if (Z_TYPE_PP(data) != IS_ARRAY) {
+
 		convert_to_string_ex(data);
+		if (Z_STRLEN_PP(data) == 0) {
+			*handler = NULL;
+			return;
+		}
 	}
 
 	zval_add_ref(data);
@@ -857,6 +862,25 @@ void _xml_characterDataHandler(void *userData, const XML_Char *s, int len)
 					
 				} else {
 					zval *tag;
+					zval **curtag, **mytype, **myval;
+					HashPosition hpos=NULL;
+
+					zend_hash_internal_pointer_end_ex(Z_ARRVAL_P(parser->data), &hpos);
+
+					if (hpos && (zend_hash_get_current_data_ex(Z_ARRVAL_P(parser->data), (void **) &curtag, &hpos) == SUCCESS)) {
+						if (zend_hash_find(Z_ARRVAL_PP(curtag),"type",sizeof("type"),(void **) &mytype) == SUCCESS) {
+							if (!strcmp(Z_STRVAL_PP(mytype), "cdata")) {
+								if (zend_hash_find(Z_ARRVAL_PP(curtag),"value",sizeof("value"),(void **) &myval) == SUCCESS) {
+									int newlen = Z_STRLEN_PP(myval) + decoded_len;
+									Z_STRVAL_PP(myval) = erealloc(Z_STRVAL_PP(myval),newlen+1);
+									strcpy(Z_STRVAL_PP(myval) + Z_STRLEN_PP(myval),decoded_value);
+									Z_STRLEN_PP(myval) += decoded_len;
+									efree(decoded_value);
+									return;
+								}
+							}
+						}
+					}
 
 					MAKE_STD_ZVAL(tag);