- MFH & BFN

diff --git a/NEWS b/NEWS
index 905fad1fe58a57055f7442d5452d5777ea2ef62d..5c20c6dd7f166843187f5f98e9e67a02d9d06721 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -12,6 +12,7 @@ PHP                                                                        NEWS
   (chsc at peytz dot dk, Felipe)
 - Fixed bug #46026 (bzip2.decompress/zlib.inflate filter tries to decompress
   after end of stream). (Keisial at gmail dot com, Greg)
+- Fixed buf #45722 (mb_check_encoding() crashes). (Moriyoshi)
 - Fixed bug #44251, #41125 (PDO + quote() + prepare() can result in segfault).
   (tsteiner at nerdclub dot net)
 - Fixed bug #42078 (pg_meta_data mix tables metadata from different schemas).

diff --git a/ext/mbstring/libmbfl/filters/mbfilter_htmlent.c b/ext/mbstring/libmbfl/filters/mbfilter_htmlent.c
index 40c24c3424e56ba389016175800e116eadd15709..6c6654a1b9ed366d6dda25fc9e84471b958638fc 100644 (file)
--- a/ext/mbstring/libmbfl/filters/mbfilter_htmlent.c
+++ b/ext/mbstring/libmbfl/filters/mbfilter_htmlent.c
@@ -232,8 +232,7 @@ int mbfl_filt_conv_html_dec(int c, mbfl_convert_filter *filter)
                                mbfl_filt_conv_html_dec_flush(filter);
                                if (c=='&')
                                {
-                                       filter->status = 1;
-                                       buffer[0] = '&';
+                                       buffer[filter->status++] = '&';
                                }
                        }
                }
@@ -244,17 +243,19 @@ int mbfl_filt_conv_html_dec(int c, mbfl_convert_filter *filter)
 int mbfl_filt_conv_html_dec_flush(mbfl_convert_filter *filter)
 {
        int status, pos = 0;
-       char *buffer;
+       unsigned char *buffer;
+       int err = 0;
 
-       buffer = (char*)filter->opaque;
+       buffer = (unsigned char*)filter->opaque;
        status = filter->status;
+       filter->status = 0;
        /* flush fragments */
        while (status--) {
-               CK((*filter->output_function)(buffer[pos++], filter->data));
+               int e = (*filter->output_function)(buffer[pos++], filter->data);
+               if (e != 0)
+                       err = e;
        }
-       filter->status = 0;
-       /*filter->buffer = 0; of cause NOT*/
-       return 0;
+       return err;
 }