From cec8b24c848bab8562c82422f3692c193f0afcdb Mon Sep 17 00:00:00 2001
From: "Christoph M. Becker" <cmbecker69@gmx.de>
Date: Thu, 13 Feb 2020 15:13:26 +0100
Subject: Fix #77569: Write Acess Violation in DomImplementation

We must not assume that the zval IS_STRING.
---
 NEWS                        |  3 +++
 ext/dom/document.c          |  2 +-
 ext/dom/tests/bug77569.phpt | 14 ++++++++++++++
 3 files changed, 18 insertions(+), 1 deletion(-)
 create mode 100644 ext/dom/tests/bug77569.phpt

diff --git a/NEWS b/NEWS
index a38b23225d..672ce05405 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,9 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2020, PHP 7.2.28
 
+- DOM:
+  . Fixed bug #77569: (Write Acess Violation in DomImplementation). (Nikita,
+    cmb)
 
 23 Jan 2020, PHP 7.2.27
 
diff --git a/ext/dom/document.c b/ext/dom/document.c
index c9e1802f78..11ef4aa818 100644
--- a/ext/dom/document.c
+++ b/ext/dom/document.c
@@ -341,7 +341,7 @@ int dom_document_encoding_write(dom_object *obj, zval *newval)
 
 	str = zval_get_string(newval);
 
-	handler = xmlFindCharEncodingHandler(Z_STRVAL_P(newval));
+	handler = xmlFindCharEncodingHandler(ZSTR_VAL(str));
 
     if (handler != NULL) {
 		xmlCharEncCloseFunc(handler);
diff --git a/ext/dom/tests/bug77569.phpt b/ext/dom/tests/bug77569.phpt
new file mode 100644
index 0000000000..f0f3566708
--- /dev/null
+++ b/ext/dom/tests/bug77569.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #77569 (Write Acess Violation in DomImplementation)
+--SKIPIF--
+<?php
+if (!extension_loaded('dom')) die('skip dom extension not available');
+?>
+--FILE--
+<?php
+$imp = new DOMImplementation;
+$dom = $imp->createDocument("", "");
+$dom->encoding = null;
+?>
+--EXPECTF--
+Warning: main(): Invalid Document Encoding in %s on line %d
-- 
cgit v1.2.1