Permalink
Browse files

Fixed bug #54601 (Removing the doctype node segfaults)

  • Loading branch information...
1 parent 69a12bf commit 07bcf1080d38e7b5e927d4d1449984b39918a030 @bjori bjori committed May 29, 2011
Showing with 32 additions and 1 deletion.
  1. +1 −0 NEWS
  2. +30 −0 ext/dom/tests/bug54601.phpt
  3. +1 −1 ext/libxml/libxml.c
View
@@ -91,6 +91,7 @@ PHP NEWS
libraries). (Clint Byrum, Raphael)
- libxml extension:
+ . Fixed bug #54601 (Removing the doctype node segfaults). (Hannes)
. Fixed bug #54440 (libxml extension ignores default context). (Gustavo)
- mbstring extension:
@@ -0,0 +1,30 @@
+--TEST--
+Segfault when removing the Doctype node
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+$xml = <<< XML
+<?xml version='1.0' encoding='utf-8' ?>
+<!DOCTYPE set PUBLIC "-//OASIS//DTD DocBook XML V5.0//EN" "http://www.docbook.org/xml/5.0/dtd/docbook.dtd" [
+<!ENTITY foo '<foo>footext</foo>'>
+<!ENTITY bar '<bar>bartext</bar>'>
+]>
+<set>&foo;&bar;</set>
+XML;
+
+$doc = new DOMDocument();
+$doc->loadXML($xml, LIBXML_NOENT);
+$n = $doc->doctype;
+$doc->removeChild($n);
+var_dump($n);
+print $doc->saveXML();
+?>
+===DONE===
+<?php exit(0); ?>
+--EXPECTF--
+object(DOMDocumentType)#%d (0) {
+}
+<?xml version="1.0" encoding="utf-8"?>
+<set><foo>footext</foo><bar>bartext</bar></set>
+===DONE===
View
@@ -222,6 +222,7 @@ static void php_libxml_node_free_list(xmlNodePtr node TSRMLS_DC)
switch (node->type) {
/* Skip property freeing for the following types */
case XML_NOTATION_NODE:
+ case XML_ENTITY_DECL:
break;
case XML_ENTITY_REF_NODE:
php_libxml_node_free_list((xmlNodePtr) node->properties TSRMLS_CC);
@@ -233,7 +234,6 @@ static void php_libxml_node_free_list(xmlNodePtr node TSRMLS_DC)
case XML_ATTRIBUTE_DECL:
case XML_DTD_NODE:
case XML_DOCUMENT_TYPE_NODE:
- case XML_ENTITY_DECL:
case XML_NAMESPACE_DECL:
case XML_TEXT_NODE:
php_libxml_node_free_list(node->children TSRMLS_CC);

0 comments on commit 07bcf10

Please sign in to comment.