From ca9033995713108d607c92f7db7ede3330fa996b Mon Sep 17 00:00:00 2001
From: Hannes Magnusson <bjori@php.net>
Date: Sun, 29 May 2011 11:39:49 +0000
Subject: [PATCH] Fixed bug #54601 (Removing the doctype node segfaults)

---
 ext/dom/tests/bug54601.phpt | 30 ++++++++++++++++++++++++++++++
 ext/libxml/libxml.c         |  2 +-
 2 files changed, 31 insertions(+), 1 deletion(-)
 create mode 100644 ext/dom/tests/bug54601.phpt

diff --git a/ext/dom/tests/bug54601.phpt b/ext/dom/tests/bug54601.phpt
new file mode 100644
index 0000000000..8a2da2dee2
--- /dev/null
+++ b/ext/dom/tests/bug54601.phpt
@@ -0,0 +1,30 @@
+--TEST--
+Segfault when removing the Doctype node
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+$xml = <<< XML
+<?xml version='1.0' encoding='utf-8' ?>
+<!DOCTYPE set PUBLIC "-//OASIS//DTD DocBook XML V5.0//EN" "http://www.docbook.org/xml/5.0/dtd/docbook.dtd" [
+<!ENTITY foo '<foo>footext</foo>'>
+<!ENTITY bar '<bar>bartext</bar>'>
+]>
+<set>&foo;&bar;</set>
+XML;
+
+$doc = new DOMDocument();
+$doc->loadXML($xml, LIBXML_NOENT);
+$n = $doc->doctype;
+$doc->removeChild($n);
+var_dump($n);
+print $doc->saveXML();
+?>
+===DONE===
+<?php exit(0); ?>
+--EXPECTF--
+object(DOMDocumentType)#%d (0) {
+}
+<?xml version="1.0" encoding="utf-8"?>
+<set><foo>footext</foo><bar>bartext</bar></set>
+===DONE===
diff --git a/ext/libxml/libxml.c b/ext/libxml/libxml.c
index 222ff98bf2..e19075cd26 100644
--- a/ext/libxml/libxml.c
+++ b/ext/libxml/libxml.c
@@ -224,6 +224,7 @@ static void php_libxml_node_free_list(xmlNodePtr node TSRMLS_DC)
 			switch (node->type) {
 				/* Skip property freeing for the following types */
 				case XML_NOTATION_NODE:
+				case XML_ENTITY_DECL:
 					break;
 				case XML_ENTITY_REF_NODE:
 					php_libxml_node_free_list((xmlNodePtr) node->properties TSRMLS_CC);
@@ -235,7 +236,6 @@ static void php_libxml_node_free_list(xmlNodePtr node TSRMLS_DC)
 				case XML_ATTRIBUTE_DECL:
 				case XML_DTD_NODE:
 				case XML_DOCUMENT_TYPE_NODE:
-				case XML_ENTITY_DECL:
 				case XML_NAMESPACE_DECL:
 				case XML_TEXT_NODE:
 					php_libxml_node_free_list(node->children TSRMLS_CC);
-- 
2.40.0