Fix for the fix for #25707

diff --git a/ext/standard/html.c b/ext/standard/html.c
index da93456abc066eff3728463eb6c5b502b782e8bf..26ae951f2e73f8cdf4e11c45cd49f073afb4312d 100644 (file)
--- a/ext/standard/html.c
+++ b/ext/standard/html.c
@@ -1076,18 +1076,26 @@ PHPAPI char *php_escape_html_entities(unsigned char *old, int oldlen, int *newle
                if (!matches_map) {     
                        int is_basic = 0;
 
-                       for (j = 0; basic_entities[j].charcode != 0; j++) {
-                               if ((basic_entities[j].charcode != this_char) ||
-                                       (basic_entities[j].flags && (quote_style & basic_entities[j].flags) == 0))
-                                       continue;
-
-                               memcpy(replaced + len, basic_entities[j].entity, basic_entities[j].entitylen);
-                               len += basic_entities[j].entitylen;
-                               
+                       if (this_char == '&') {
+                               memcpy(replaced + len, "&", sizeof("&") - 1);
+                               len += sizeof("&") - 1;
                                is_basic = 1;
-                               break;
+                       } else {
+                               for (j = 0; basic_entities[j].charcode != 0; j++) {
+                                       if ((basic_entities[j].charcode != this_char) ||
+                                                       (basic_entities[j].flags &&
+                                                       (quote_style & basic_entities[j].flags) == 0)) {
+                                               continue;
+                                       }
 
+                                       memcpy(replaced + len, basic_entities[j].entity, basic_entities[j].entitylen);
+                                       len += basic_entities[j].entitylen;
+               
+                                       is_basic = 1;
+                                       break;
+                               }
                        }
+
                        if (!is_basic) {
                                /* a wide char without a named entity; pass through the original sequence */
                                if (mbseqlen > 1) {