diff options
| -rw-r--r-- | ext/dom/tests/bug54601.phpt | 30 | ||||
| -rw-r--r-- | ext/libxml/libxml.c | 2 |
2 files changed, 31 insertions, 1 deletions
diff --git a/ext/dom/tests/bug54601.phpt b/ext/dom/tests/bug54601.phpt new file mode 100644 index 0000000000..8a2da2dee2 --- /dev/null +++ b/ext/dom/tests/bug54601.phpt @@ -0,0 +1,30 @@ +--TEST-- +Segfault when removing the Doctype node +--SKIPIF-- +<?php require_once('skipif.inc'); ?> +--FILE-- +<?php +$xml = <<< XML +<?xml version='1.0' encoding='utf-8' ?> +<!DOCTYPE set PUBLIC "-//OASIS//DTD DocBook XML V5.0//EN" "http://www.docbook.org/xml/5.0/dtd/docbook.dtd" [ +<!ENTITY foo '<foo>footext</foo>'> +<!ENTITY bar '<bar>bartext</bar>'> +]> +<set>&foo;&bar;</set> +XML; + +$doc = new DOMDocument(); +$doc->loadXML($xml, LIBXML_NOENT); +$n = $doc->doctype; +$doc->removeChild($n); +var_dump($n); +print $doc->saveXML(); +?> +===DONE=== +<?php exit(0); ?> +--EXPECTF-- +object(DOMDocumentType)#%d (0) { +} +<?xml version="1.0" encoding="utf-8"?> +<set><foo>footext</foo><bar>bartext</bar></set> +===DONE=== diff --git a/ext/libxml/libxml.c b/ext/libxml/libxml.c index 222ff98bf2..e19075cd26 100644 --- a/ext/libxml/libxml.c +++ b/ext/libxml/libxml.c @@ -224,6 +224,7 @@ static void php_libxml_node_free_list(xmlNodePtr node TSRMLS_DC) switch (node->type) { /* Skip property freeing for the following types */ case XML_NOTATION_NODE: + case XML_ENTITY_DECL: break; case XML_ENTITY_REF_NODE: php_libxml_node_free_list((xmlNodePtr) node->properties TSRMLS_CC); @@ -235,7 +236,6 @@ static void php_libxml_node_free_list(xmlNodePtr node TSRMLS_DC) case XML_ATTRIBUTE_DECL: case XML_DTD_NODE: case XML_DOCUMENT_TYPE_NODE: - case XML_ENTITY_DECL: case XML_NAMESPACE_DECL: case XML_TEXT_NODE: php_libxml_node_free_list(node->children TSRMLS_CC); |