Fixed bug #54601 (Removing the doctype node segfaults)

diff --git a/ext/dom/tests/bug54601.phpt b/ext/dom/tests/bug54601.phpt
new file mode 100644 (file)
index 0000000..8a2da2d
--- /dev/null
+++ b/ext/dom/tests/bug54601.phpt
@@ -0,0 +1,30 @@
+--TEST--
+Segfault when removing the Doctype node
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+$xml = <<< XML
+<?xml version='1.0' encoding='utf-8' ?>
+<!DOCTYPE set PUBLIC "-//OASIS//DTD DocBook XML V5.0//EN" "http://www.docbook.org/xml/5.0/dtd/docbook.dtd" [
+<!ENTITY foo '<foo>footext</foo>'>
+<!ENTITY bar '<bar>bartext</bar>'>
+]>
+<set>&foo;&bar;</set>
+XML;
+
+$doc = new DOMDocument();
+$doc->loadXML($xml, LIBXML_NOENT);
+$n = $doc->doctype;
+$doc->removeChild($n);
+var_dump($n);
+print $doc->saveXML();
+?>
+===DONE===
+<?php exit(0); ?>
+--EXPECTF--
+object(DOMDocumentType)#%d (0) {
+}
+<?xml version="1.0" encoding="utf-8"?>
+<set><foo>footext</foo><bar>bartext</bar></set>
+===DONE===

diff --git a/ext/libxml/libxml.c b/ext/libxml/libxml.c
index 222ff98bf24216c88ddb3db9dc5de1e2fbd24cbe..e19075cd263a40faa9f6a049a23965c48cd97696 100644 (file)
--- a/ext/libxml/libxml.c
+++ b/ext/libxml/libxml.c
@@ -224,6 +224,7 @@ static void php_libxml_node_free_list(xmlNodePtr node TSRMLS_DC)
                        switch (node->type) {
                                /* Skip property freeing for the following types */
                                case XML_NOTATION_NODE:
+                               case XML_ENTITY_DECL:
                                        break;
                                case XML_ENTITY_REF_NODE:
                                        php_libxml_node_free_list((xmlNodePtr) node->properties TSRMLS_CC);
@@ -235,7 +236,6 @@ static void php_libxml_node_free_list(xmlNodePtr node TSRMLS_DC)
                                case XML_ATTRIBUTE_DECL:
                                case XML_DTD_NODE:
                                case XML_DOCUMENT_TYPE_NODE:
-                               case XML_ENTITY_DECL:
                                case XML_NAMESPACE_DECL:
                                case XML_TEXT_NODE:
                                        php_libxml_node_free_list(node->children TSRMLS_CC);