Fixed bug #21338 (crash inside html_entity_decode() when "" is passed).

Added test case for the bug.

diff --git a/ext/standard/html.c b/ext/standard/html.c
index 5385d5609ccd3bded909b40eecd4115fec44a626..4e7d51be5985b593cc7f634bacf3df6b0de8e7c2 100644 (file)
--- a/ext/standard/html.c
+++ b/ext/standard/html.c
@@ -674,6 +674,9 @@ PHPAPI char *php_unescape_html_entities(unsigned char *old, int oldlen, int *new
        
        ret = estrdup(old);
        retlen = oldlen;
+       if (!retlen) {
+               goto empty_source;
+       }
        
        if (all) {
                /* look for a match in the maps for this charset */
@@ -722,7 +725,7 @@ PHPAPI char *php_unescape_html_entities(unsigned char *old, int oldlen, int *new
                efree(ret);
                ret = replaced;
        }
-       
+empty_source:  
        *newlen = retlen;
        return ret;
 }

diff --git a/ext/standard/tests/strings/bug21338.phpt b/ext/standard/tests/strings/bug21338.phpt
new file mode 100644 (file)
index 0000000..c845765
--- /dev/null
+++ b/ext/standard/tests/strings/bug21338.phpt
@@ -0,0 +1,10 @@
+--TEST--
+Bug #20934 (html_entity_decode() crash when "" is passed)
+--FILE--
+<?php
+       var_dump(html_entity_decode(NULL));
+       var_dump(html_entity_decode(""));
+?>
+--EXPECT--
+string(0) ""
+string(0) ""