- Fixed bug #51615 (PHP crash with wrong HTML in SimpleXML)

diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c
index 729e13106a68dba8dcd7ce399757320511af0115..b07187819064cd9ff4ae926ff17009eaf34d85a8 100644 (file)
--- a/ext/simplexml/simplexml.c
+++ b/ext/simplexml/simplexml.c
@@ -988,9 +988,14 @@ static void sxe_dimension_delete(zval *object, zval *offset TSRMLS_DC)
 static inline char * sxe_xmlNodeListGetString(xmlDocPtr doc, xmlNodePtr list, int inLine) /* {{{ */
 {
        xmlChar *tmp = xmlNodeListGetString(doc, list, inLine);
-       char    *res = estrdup((char*)tmp);
-
-       xmlFree(tmp);
+       char    *res;
+       
+       if (tmp) {
+               res = estrdup((char*)tmp);
+               xmlFree(tmp);
+       } else {
+               res = STR_EMPTY_ALLOC();
+       }
 
        return res;
 }

diff --git a/ext/simplexml/tests/bug51615.phpt b/ext/simplexml/tests/bug51615.phpt
new file mode 100644 (file)
index 0000000..c5572f5
--- /dev/null
+++ b/ext/simplexml/tests/bug51615.phpt
@@ -0,0 +1,22 @@
+--TEST--
+Bug #51615 (PHP crash with wrong HTML in SimpleXML)
+--SKIPIF--
+<?php if (!extension_loaded("simplexml")) print "skip"; ?>
+--FILE--
+<?php
+
+$dom = new DOMDocument;
+$dom->loadHTML('<span title=""y">x</span><span title=""z">x</span>');
+$html = simplexml_import_dom($dom);
+
+foreach ($html->body->span as $obj) {
+       var_dump((string)$obj->title);
+}
+
+?>
+--EXPECTF--
+Warning: DOMDocument::loadHTML(): error parsing attribute name in Entity, line: 1 in %s on line %d
+
+Warning: DOMDocument::loadHTML(): error parsing attribute name in Entity, line: 1 in %s on line %d
+string(0) ""
+string(0) ""