fix a few crashes

diff --git a/ext/tidy/tidy.c b/ext/tidy/tidy.c
index 0492b0840c74b4a91e7804a6f7782e74da85288c..76a08ed9150c62943ddf10fa2e9eb0b8c1b575c2 100644 (file)
--- a/ext/tidy/tidy.c
+++ b/ext/tidy/tidy.c
@@ -515,7 +515,7 @@ static void php_tidy_quick_repair(INTERNAL_FUNCTION_PARAMETERS, zend_bool is_fil
                                tidyBufInit(&output);
 
                                tidySaveBuffer (doc, &output);
-                               RETVAL_STRINGL(output.bp, output.size-1, 1);
+                               RETVAL_STRINGL(output.bp, output.size ? output.size-1 : 0, 1);
                                tidyBufFree(&output);
                        } else {
                                RETVAL_FALSE;
@@ -683,7 +683,7 @@ static int tidy_doc_cast_handler(zval *in, zval *out, int type TSRMLS_DC)
                        obj = (PHPTidyObj *)zend_object_store_get_object(in TSRMLS_CC);
                        tidyBufInit(&output);
                        tidySaveBuffer (obj->ptdoc->doc, &output);
-                       ZVAL_STRINGL(out, output.bp, output.size-1, TRUE);
+                       ZVAL_STRINGL(out, output.bp, output.size ? output.size-1 : 0, TRUE);
                        tidyBufFree(&output);
                        break;
 
@@ -1037,7 +1037,7 @@ static PHP_FUNCTION(ob_tidyhandler)
                        tidyBufInit(&output);
 
                        tidySaveBuffer(doc, &output);
-                       RETVAL_STRINGL(output.bp, output.size-1, 1);
+                       RETVAL_STRINGL(output.bp, output.size ? output.size-1 : 0, 1);
 
                        tidyBufFree(&output);
                }
@@ -1103,7 +1103,7 @@ static PHP_FUNCTION(tidy_get_output)
        tidyBufInit(&output);
        tidySaveBuffer(obj->ptdoc->doc, &output);
 
-       RETVAL_STRINGL(output.bp, output.size-1, 1);
+       RETVAL_STRINGL(output.bp, output.size ? output.size-1 : 0, 1);
 
        tidyBufFree(&output);
 }