diff options
| -rw-r--r-- | ext/simplexml/simplexml.c | 11 | ||||
| -rw-r--r-- | ext/simplexml/tests/bug51615.phpt | 22 |
2 files changed, 30 insertions, 3 deletions
diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c index 729e13106a..b071878190 100644 --- a/ext/simplexml/simplexml.c +++ b/ext/simplexml/simplexml.c @@ -988,9 +988,14 @@ static void sxe_dimension_delete(zval *object, zval *offset TSRMLS_DC) static inline char * sxe_xmlNodeListGetString(xmlDocPtr doc, xmlNodePtr list, int inLine) /* {{{ */ { xmlChar *tmp = xmlNodeListGetString(doc, list, inLine); - char *res = estrdup((char*)tmp); - - xmlFree(tmp); + char *res; + + if (tmp) { + res = estrdup((char*)tmp); + xmlFree(tmp); + } else { + res = STR_EMPTY_ALLOC(); + } return res; } diff --git a/ext/simplexml/tests/bug51615.phpt b/ext/simplexml/tests/bug51615.phpt new file mode 100644 index 0000000000..c5572f542a --- /dev/null +++ b/ext/simplexml/tests/bug51615.phpt @@ -0,0 +1,22 @@ +--TEST-- +Bug #51615 (PHP crash with wrong HTML in SimpleXML) +--SKIPIF-- +<?php if (!extension_loaded("simplexml")) print "skip"; ?> +--FILE-- +<?php + +$dom = new DOMDocument; +$dom->loadHTML('<span title=""y">x</span><span title=""z">x</span>'); +$html = simplexml_import_dom($dom); + +foreach ($html->body->span as $obj) { + var_dump((string)$obj->title); +} + +?> +--EXPECTF-- +Warning: DOMDocument::loadHTML(): error parsing attribute name in Entity, line: 1 in %s on line %d + +Warning: DOMDocument::loadHTML(): error parsing attribute name in Entity, line: 1 in %s on line %d +string(0) "" +string(0) "" |