MFH: Fixed bug #32608 (html_entity_decode() converts single quotes even if

ENT_NOQUOTES is given).

diff --git a/NEWS b/NEWS
index 5b1094b6dcd6f6c87741c191332329c8121e4da3..536d04254ab4e87cf82ec543c68357815c67fa71 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -33,6 +33,8 @@ PHP                                                                        NEWS
   can crash PHP). (Jani)
 - Fixed bug #32615 (Segfault in replaceChild() using fragment when 
   previousSibling is NULL). (Rob)
+- Fixed bug #32608 (html_entity_decode() converts single quotes even if
+  ENT_NOQUOTES is given). (Ilia)
 - Fixed bug #32591 (ext/mysql: Unsatisfied symbol: ntohs with HP-UX). (Jani)
 - Fixed bug #32589 (Possible crash inside imap_mail_compose, with charsets).
   (Ilia)

diff --git a/ext/standard/html.c b/ext/standard/html.c
index 05e2c385128a2e2eafca840dc98edd468a7c4bf4..720a494e972ce4e15ce983e692c6d5c7bd70d527 100644 (file)
--- a/ext/standard/html.c
+++ b/ext/standard/html.c
@@ -117,7 +117,7 @@ static entity_table_t ent_uni_338_402[] = {
        "Yuml", NULL, NULL, NULL, NULL, NULL, NULL, NULL,
        NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
        NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, */
-       /* 400 (0x0190)*/
+       /* 400 (0x0192)*/
        NULL, NULL, "fnof"
 };
 
@@ -988,7 +988,11 @@ PHPAPI char *php_unescape_html_entities(unsigned char *old, int oldlen, int *new
                                                                if ((code >= 0x80 && code < 0xa0) || code > 0xff) {
                                                                        invalid_code = 1;
                                                                } else {
-                                                                       *(q++) = code;
+                                                                       if (code == 39 || !quote_style) {
+                                                                               invalid_code = 1;
+                                                                       } else {
+                                                                               *(q++) = code;
+                                                                       }
                                                                }
                                                                break;