From: Benjamin Eberlei <kontakt@beberlei.de>
Date: Thu, 5 Mar 2020 23:03:13 +0000 (+0100)
Subject: Fix another memory leak in dom_zvals_to_fragment.
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=0d913f9acf821f4d3074ac457b93d7c478edbcc5;p=php

Fix another memory leak in dom_zvals_to_fragment.
---

diff --git a/ext/dom/parentnode.c b/ext/dom/parentnode.c
index be30c79261..a9502a5159 100644
--- a/ext/dom/parentnode.c
+++ b/ext/dom/parentnode.c
@@ -179,6 +179,13 @@ xmlNode* dom_zvals_to_fragment(php_libxml_ref_obj *document, xmlNode *contextNod
 				newNodeObj->document = document;
 				xmlSetTreeDoc(newNode, documentNode);
 
+				if (newNode->type == XML_ATTRIBUTE_NODE) {
+					xmlFree(fragment);
+
+					php_dom_throw_error(HIERARCHY_REQUEST_ERR, stricterror);
+					return NULL;
+				}
+
 				if (!xmlAddChild(fragment, newNode)) {
 					xmlFree(fragment);
 
diff --git a/ext/dom/tests/DOM4_ParentNode_append_with_attributes.phpt b/ext/dom/tests/DOM4_ParentNode_append_with_attributes.phpt
index 3fb266729a..f2c6aa9a6d 100644
--- a/ext/dom/tests/DOM4_ParentNode_append_with_attributes.phpt
+++ b/ext/dom/tests/DOM4_ParentNode_append_with_attributes.phpt
@@ -19,8 +19,12 @@ $element = $dom->documentElement;
 try {
     $element->append($replacement, $addition);
 } catch (DOMException $e) {
-    echo $e->getMessage();
+    echo $e->getMessage() . "\n";
 }
+
+echo $dom->saveXML();
 ?>
 --EXPECT--
 Hierarchy Request Error
+<?xml version="1.0"?>
+<test attr-one="21"/>