- fix crash with DOMImplementation::createDocumentType("name:")

diff --git a/NEWS b/NEWS
index d4c778fc1b8185dc23d418559bb38b57915b5a73..8f4d8992df1cbce2eaf0179cca798a6c71335b29 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -26,6 +26,7 @@ PHP                                                                        NEWS
   (Mike)
 - Fixed tiger hash algorithm generating wrong results on big endian platforms.
   (Mike)
+- Fixed crash with DOMImplementation::createDocumentType("name:"). (Mike)
 - Fixed bug #36458 (sleep() accepts negative values). (Ilia)
 - Fixed bug #36436 (DBA problem with Berkeley DB4). (Marcus)
 - Fixed bug #36434 (Improper resolution of declaring class name of an inherited

diff --git a/ext/dom/domimplementation.c b/ext/dom/domimplementation.c
index aa371f81540672eaf7ab7fd00644d77d6a9e3763..f65da0572bc6b78433d0db99856ce4a4d26c469d 100644 (file)
--- a/ext/dom/domimplementation.c
+++ b/ext/dom/domimplementation.c
@@ -92,7 +92,7 @@ PHP_METHOD(domimplementation, createDocumentType)
                pch2 = systemid;
 
        uri = xmlParseURI(name);
-       if (uri->opaque != NULL) {
+       if (uri != NULL && uri->opaque != NULL) {
                localname = xmlStrdup(uri->opaque);
                if (xmlStrchr(localname, (xmlChar) ':') != NULL) {
                        php_dom_throw_error(NAMESPACE_ERR, 1 TSRMLS_CC);
@@ -108,7 +108,9 @@ PHP_METHOD(domimplementation, createDocumentType)
        php_dom_throw_error(INVALID_CHARACTER_ERR, TSRMLS_CC);
        */
 
-       xmlFreeURI(uri);
+       if (uri) {
+               xmlFreeURI(uri);
+       }
 
        doctype = xmlCreateIntSubset(NULL, localname, pch1, pch2);
        xmlFree(localname);