- Fixed bug #54682 (Tidy::diagnose() NULL pointer dereference)

diff --git a/NEWS b/NEWS
index ce86effc8ee7937f2962ade2e9577e00b6f2396f..0e60c1e3d0a476d670b2013c4562cfbb10dc5c27 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -18,6 +18,10 @@ PHP                                                                        NEWS
 - Output:
   . Fixed bug #60282 (Segfault when using ob_gzhandler() with open buffers).
     (Laruence)
+    
+- Tidy:
+  . Fixed bug #54682 (Tidy::diagnose() NULL pointer dereference).
+    (Maksymilian Arciemowicz, Felipe)
 
 -CLI SAPI:
   . Fixed bug #60159 (Router returns false, but POST is not passed to requested

diff --git a/ext/tidy/tests/bug54682.phpt b/ext/tidy/tests/bug54682.phpt
new file mode 100644 (file)
index 0000000..99f40cf
--- /dev/null
+++ b/ext/tidy/tests/bug54682.phpt
@@ -0,0 +1,13 @@
+--TEST--
+Tidy::diagnose() NULL pointer dereference
+--SKIPIF--
+<?php if (!extension_loaded("tidy")) print "skip"; ?>
+--FILE--
+<?php
+
+$nx = new Tidy("*");
+$nx->diagnose();
+
+?>
+--EXPECTF--
+Warning: tidy::__construct(): Cannot Load '*' into memory in %s on line %d

diff --git a/ext/tidy/tidy.c b/ext/tidy/tidy.c
index 1ba910c9578ec0d75b53f4479655df2f3e4553c3..d06bbcdb2e7d23926099090d87cf09c791f57fb0 100644 (file)
--- a/ext/tidy/tidy.c
+++ b/ext/tidy/tidy.c
@@ -1336,7 +1336,7 @@ static PHP_FUNCTION(tidy_diagnose)
 {
        TIDY_FETCH_OBJECT;
 
-       if (tidyRunDiagnostics(obj->ptdoc->doc) >= 0) {
+       if (tidyStatus(obj->ptdoc->doc) != 0 && tidyRunDiagnostics(obj->ptdoc->doc) >= 0) {
                tidy_doc_update_properties(obj TSRMLS_CC);
                RETURN_TRUE;
        }