Fix bug #27467: domDocument::load() called from class method crashes

the methods can be called statically only from within classes which
  are not extending DomDocument

diff --git a/ext/dom/document.c b/ext/dom/document.c
index c53b7bdb3c39ec09d68c6ce1d09754afdb672fe0..465725a2b3ed63a536d669511e2e52d3e11c1070 100644 (file)
--- a/ext/dom/document.c
+++ b/ext/dom/document.c
@@ -1484,7 +1484,10 @@ static void dom_parse_document(INTERNAL_FUNCTION_PARAMETERS, int mode) {
        int source_len, refcount, ret;
 
        id = getThis();
-       
+       if (id != NULL && ! instanceof_function(Z_OBJCE_P(id), dom_document_class_entry TSRMLS_CC)) {
+               id = NULL;
+       }
+
        if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &source, &source_len) == FAILURE) {
                return;
        }
@@ -1978,7 +1981,7 @@ static void dom_load_html(INTERNAL_FUNCTION_PARAMETERS, int mode)
        if (!newdoc)
                RETURN_FALSE;
 
-       if (id != NULL) {
+       if (id != NULL && instanceof_function(Z_OBJCE_P(id), dom_document_class_entry TSRMLS_CC)) {
                intern = (dom_object *)zend_object_store_get_object(id TSRMLS_CC);
                if (intern != NULL) {
                        docp = (xmlDocPtr) dom_object_get_node(intern);