MFB: Fixed bug #43099 (XMLWriter::endElement() does not check # of params)

diff --git a/NEWS b/NEWS
index fe2a66dfae2d48fe0aec03a81df6919b972ad0d8..c5fc470a676657f931d228869b072a238652e4f1 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -37,6 +37,8 @@ PHP                                                                        NEWS
 - Fixed htmlentities/htmlspecialchars not to accept partial multibyte
   sequences. (Stas)
 
+- Fixed bug #43099 (XMLWriter::endElement() does not check # of params).
+  (Ilia)
 - Fixed bug #43020 (Warning message is missing with shuffle() and more
   than one argument). (Scott)
 - Fixed bug #4294 (Move *timeout initialization from RINIT to connect time).

diff --git a/ext/xmlwriter/php_xmlwriter.c b/ext/xmlwriter/php_xmlwriter.c
index 45a0d912c106a4960f6a76a7debdd3492edabd9f..5fcdc54b0b558c9274b98beb6c41897a4bc85211 100644 (file)
--- a/ext/xmlwriter/php_xmlwriter.c
+++ b/ext/xmlwriter/php_xmlwriter.c
@@ -464,6 +464,9 @@ static void php_xmlwriter_end(INTERNAL_FUNCTION_PARAMETERS, xmlwriter_read_int_t
        
        if (this) {
                XMLWRITER_FROM_OBJECT(intern, this);
+               if (ZEND_NUM_ARGS()) {
+                       WRONG_PARAM_COUNT;
+               }
        } else 
 #endif
        {