diff options
| author | Felipe Pena <felipe@php.net> | 2010-04-20 16:24:21 +0000 |
|---|---|---|
| committer | Felipe Pena <felipe@php.net> | 2010-04-20 16:24:21 +0000 |
| commit | 3a0a2af52c0d1145b546f77d9e869baaa2ce6844 (patch) | |
| tree | 0878e001626c1a20df0f66b34a0fd01c8fe97bd3 | |
| parent | b7bd1167a958ac356b31db5acb469a81086a7b78 (diff) | |
| download | php-git-3a0a2af52c0d1145b546f77d9e869baaa2ce6844.tar.gz | |
- Fixed bug #51615 (PHP crash with wrong HTML in SimpleXML)
| -rw-r--r-- | ext/simplexml/simplexml.c | 11 | ||||
| -rw-r--r-- | ext/simplexml/tests/bug51615.phpt | 22 |
2 files changed, 30 insertions, 3 deletions
diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c index 729e13106a..b071878190 100644 --- a/ext/simplexml/simplexml.c +++ b/ext/simplexml/simplexml.c @@ -988,9 +988,14 @@ static void sxe_dimension_delete(zval *object, zval *offset TSRMLS_DC) static inline char * sxe_xmlNodeListGetString(xmlDocPtr doc, xmlNodePtr list, int inLine) /* {{{ */ { xmlChar *tmp = xmlNodeListGetString(doc, list, inLine); - char *res = estrdup((char*)tmp); - - xmlFree(tmp); + char *res; + + if (tmp) { + res = estrdup((char*)tmp); + xmlFree(tmp); + } else { + res = STR_EMPTY_ALLOC(); + } return res; } diff --git a/ext/simplexml/tests/bug51615.phpt b/ext/simplexml/tests/bug51615.phpt new file mode 100644 index 0000000000..c5572f542a --- /dev/null +++ b/ext/simplexml/tests/bug51615.phpt @@ -0,0 +1,22 @@ +--TEST-- +Bug #51615 (PHP crash with wrong HTML in SimpleXML) +--SKIPIF-- +<?php if (!extension_loaded("simplexml")) print "skip"; ?> +--FILE-- +<?php + +$dom = new DOMDocument; +$dom->loadHTML('<span title=""y">x</span><span title=""z">x</span>'); +$html = simplexml_import_dom($dom); + +foreach ($html->body->span as $obj) { + var_dump((string)$obj->title); +} + +?> +--EXPECTF-- +Warning: DOMDocument::loadHTML(): error parsing attribute name in Entity, line: 1 in %s on line %d + +Warning: DOMDocument::loadHTML(): error parsing attribute name in Entity, line: 1 in %s on line %d +string(0) "" +string(0) "" |