From: Moriyoshi Koizumi <moriyoshi@php.net>
Date: Thu, 16 Oct 2008 01:02:39 +0000 (+0000)
Subject: - MFH & BFN
X-Git-Tag: php-5.2.7RC2~34
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=d896ea0b9ab42aa064c25cef6443ac656b70d64b;p=php

- MFH & BFN
---

diff --git a/NEWS b/NEWS
index 905fad1fe5..5c20c6dd7f 100644
--- a/NEWS
+++ b/NEWS
@@ -12,6 +12,7 @@ PHP                                                                        NEWS
   (chsc at peytz dot dk, Felipe)
 - Fixed bug #46026 (bzip2.decompress/zlib.inflate filter tries to decompress
   after end of stream). (Keisial at gmail dot com, Greg)
+- Fixed buf #45722 (mb_check_encoding() crashes). (Moriyoshi)
 - Fixed bug #44251, #41125 (PDO + quote() + prepare() can result in segfault).
   (tsteiner at nerdclub dot net)
 - Fixed bug #42078 (pg_meta_data mix tables metadata from different schemas).
diff --git a/ext/mbstring/libmbfl/filters/mbfilter_htmlent.c b/ext/mbstring/libmbfl/filters/mbfilter_htmlent.c
index 40c24c3424..6c6654a1b9 100644
--- a/ext/mbstring/libmbfl/filters/mbfilter_htmlent.c
+++ b/ext/mbstring/libmbfl/filters/mbfilter_htmlent.c
@@ -232,8 +232,7 @@ int mbfl_filt_conv_html_dec(int c, mbfl_convert_filter *filter)
 				mbfl_filt_conv_html_dec_flush(filter);
 				if (c=='&')
 				{
-					filter->status = 1;
-					buffer[0] = '&';
+					buffer[filter->status++] = '&';
 				}
 			}
 		}
@@ -244,17 +243,19 @@ int mbfl_filt_conv_html_dec(int c, mbfl_convert_filter *filter)
 int mbfl_filt_conv_html_dec_flush(mbfl_convert_filter *filter)
 {
 	int status, pos = 0;
-	char *buffer;
+	unsigned char *buffer;
+	int err = 0;
 
-	buffer = (char*)filter->opaque;
+	buffer = (unsigned char*)filter->opaque;
 	status = filter->status;
+	filter->status = 0;
 	/* flush fragments */
 	while (status--) {
-		CK((*filter->output_function)(buffer[pos++], filter->data));
+		int e = (*filter->output_function)(buffer[pos++], filter->data);
+		if (e != 0)
+			err = e;
 	}
-	filter->status = 0;
-	/*filter->buffer = 0; of cause NOT*/
-	return 0;
+	return err;
 }