From: Felipe Pena <felipe@php.net>
Date: Tue, 15 Nov 2011 15:16:20 +0000 (+0000)
Subject: - Fixed bug #54682 (Tidy::diagnose() NULL pointer dereference)
X-Git-Tag: php-5.4.0RC2~74
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=236120d80e266dc40d9542486fc31e0f8e0b9344;p=php

- Fixed bug #54682 (Tidy::diagnose() NULL pointer dereference)
---

diff --git a/NEWS b/NEWS
index ce86effc8e..0e60c1e3d0 100644
--- a/NEWS
+++ b/NEWS
@@ -18,6 +18,10 @@ PHP                                                                        NEWS
 - Output:
   . Fixed bug #60282 (Segfault when using ob_gzhandler() with open buffers).
     (Laruence)
+    
+- Tidy:
+  . Fixed bug #54682 (Tidy::diagnose() NULL pointer dereference).
+    (Maksymilian Arciemowicz, Felipe)
 
 -CLI SAPI:
   . Fixed bug #60159 (Router returns false, but POST is not passed to requested
diff --git a/ext/tidy/tests/bug54682.phpt b/ext/tidy/tests/bug54682.phpt
new file mode 100644
index 0000000000..99f40cf9d2
--- /dev/null
+++ b/ext/tidy/tests/bug54682.phpt
@@ -0,0 +1,13 @@
+--TEST--
+Tidy::diagnose() NULL pointer dereference
+--SKIPIF--
+<?php if (!extension_loaded("tidy")) print "skip"; ?>
+--FILE--
+<?php
+
+$nx = new Tidy("*");
+$nx->diagnose();
+
+?>
+--EXPECTF--
+Warning: tidy::__construct(): Cannot Load '*' into memory in %s on line %d
diff --git a/ext/tidy/tidy.c b/ext/tidy/tidy.c
index 1ba910c957..d06bbcdb2e 100644
--- a/ext/tidy/tidy.c
+++ b/ext/tidy/tidy.c
@@ -1336,7 +1336,7 @@ static PHP_FUNCTION(tidy_diagnose)
 {
 	TIDY_FETCH_OBJECT;
 
-	if (tidyRunDiagnostics(obj->ptdoc->doc) >= 0) {
+	if (tidyStatus(obj->ptdoc->doc) != 0 && tidyRunDiagnostics(obj->ptdoc->doc) >= 0) {
 		tidy_doc_update_properties(obj TSRMLS_CC);
 		RETURN_TRUE;
 	}