svn: /php/php-src/ branches/PHP_5_3/NEWS branches/PHP_5_3/ext/tidy/tests/bug54682.phpt branches/PHP_5_3/ext/tidy/tidy.c branches/PHP_5_4/NEWS
branches/PHP_5_4/ext/tidy/tests/bug54682.phpt branches/PHP_5_4/ext/tidy/tidy.c trunk/ext/tidy/tests/bug54682.phpt trunk/ext/tidy/tidy.c

felipe Tue, 15 Nov 2011 15:16:20 +0000 Revision: http://svn.php.net/viewvc?view=revision&revision=319254 Log: - Fixed bug #54682 (Tidy::diagnose() NULL pointer dereference) Bug: https://bugs.php.net/54682 (Open) tidy NullPD Changed paths: U php/php-src/branches/PHP_5_3/NEWS A php/php-src/branches/PHP_5_3/ext/tidy/tests/bug54682.phpt U php/php-src/branches/PHP_5_3/ext/tidy/tidy.c U php/php-src/branches/PHP_5_4/NEWS A php/php-src/branches/PHP_5_4/ext/tidy/tests/bug54682.phpt U php/php-src/branches/PHP_5_4/ext/tidy/tidy.c A php/php-src/trunk/ext/tidy/tests/bug54682.phpt U php/php-src/trunk/ext/tidy/tidy.c Modified: php/php-src/branches/PHP_5_3/NEWS =================================================================== --- php/php-src/branches/PHP_5_3/NEWS 2011-11-15 14:20:13 UTC (rev 319253) +++ php/php-src/branches/PHP_5_3/NEWS 2011-11-15 15:16:20 UTC (rev 319254) @@ -27,6 +27,10 @@ - SOAP . Fixed bug #44686 (SOAP-ERROR: Parsing WSDL with references). (Dmitry) + +- Tidy: + . Fixed bug #54682 (Tidy::diagnose() NULL pointer dereference). + (Maksymilian Arciemowicz, Felipe) 03 Nov 2011, PHP 5.3.9RC1 Added: php/php-src/branches/PHP_5_3/ext/tidy/tests/bug54682.phpt =================================================================== --- php/php-src/branches/PHP_5_3/ext/tidy/tests/bug54682.phpt (rev 0) +++ php/php-src/branches/PHP_5_3/ext/tidy/tests/bug54682.phpt 2011-11-15 15:16:20 UTC (rev 319254) @@ -0,0 +1,13 @@ +--TEST-- +Tidy::diagnose() NULL pointer dereference +--SKIPIF-- +<?php if (!extension_loaded("tidy")) print "skip"; ?> +--FILE-- +<?php + +$nx = new Tidy("*"); +$nx->diagnose(); + +?> +--EXPECTF-- +Warning: tidy::__construct(): Cannot Load '*' into memory in %s on line %d Modified: php/php-src/branches/PHP_5_3/ext/tidy/tidy.c =================================================================== --- php/php-src/branches/PHP_5_3/ext/tidy/tidy.c 2011-11-15 14:20:13 UTC (rev 319253) +++ php/php-src/branches/PHP_5_3/ext/tidy/tidy.c 2011-11-15 15:16:20 UTC (rev 319254) @@ -1288,7 +1288,7 @@ { TIDY_FETCH_OBJECT; - if (tidyRunDiagnostics(obj->ptdoc->doc) >= 0) { + if (tidyStatus(obj->ptdoc->doc) != 0 && tidyRunDiagnostics(obj->ptdoc->doc) >= 0) { tidy_doc_update_properties(obj TSRMLS_CC); RETURN_TRUE; } Modified: php/php-src/branches/PHP_5_4/NEWS =================================================================== --- php/php-src/branches/PHP_5_4/NEWS 2011-11-15 14:20:13 UTC (rev 319253) +++ php/php-src/branches/PHP_5_4/NEWS 2011-11-15 15:16:20 UTC (rev 319254) @@ -18,6 +18,10 @@ - Output: . Fixed bug #60282 (Segfault when using ob_gzhandler() with open buffers). (Laruence) + +- Tidy: + . Fixed bug #54682 (Tidy::diagnose() NULL pointer dereference). + (Maksymilian Arciemowicz, Felipe) -CLI SAPI: . Fixed bug #60159 (Router returns false, but POST is not passed to requested Added: php/php-src/branches/PHP_5_4/ext/tidy/tests/bug54682.phpt =================================================================== --- php/php-src/branches/PHP_5_4/ext/tidy/tests/bug54682.phpt (rev 0) +++ php/php-src/branches/PHP_5_4/ext/tidy/tests/bug54682.phpt 2011-11-15 15:16:20 UTC (rev 319254) @@ -0,0 +1,13 @@ +--TEST-- +Tidy::diagnose() NULL pointer dereference +--SKIPIF-- +<?php if (!extension_loaded("tidy")) print "skip"; ?> +--FILE-- +<?php + +$nx = new Tidy("*"); +$nx->diagnose(); + +?> +--EXPECTF-- +Warning: tidy::__construct(): Cannot Load '*' into memory in %s on line %d Modified: php/php-src/branches/PHP_5_4/ext/tidy/tidy.c =================================================================== --- php/php-src/branches/PHP_5_4/ext/tidy/tidy.c 2011-11-15 14:20:13 UTC (rev 319253) +++ php/php-src/branches/PHP_5_4/ext/tidy/tidy.c 2011-11-15 15:16:20 UTC (rev 319254) @@ -1336,7 +1336,7 @@ { TIDY_FETCH_OBJECT; - if (tidyRunDiagnostics(obj->ptdoc->doc) >= 0) { + if (tidyStatus(obj->ptdoc->doc) != 0 && tidyRunDiagnostics(obj->ptdoc->doc) >= 0) { tidy_doc_update_properties(obj TSRMLS_CC); RETURN_TRUE; } Added: php/php-src/trunk/ext/tidy/tests/bug54682.phpt =================================================================== --- php/php-src/trunk/ext/tidy/tests/bug54682.phpt (rev 0) +++ php/php-src/trunk/ext/tidy/tests/bug54682.phpt 2011-11-15 15:16:20 UTC (rev 319254) @@ -0,0 +1,13 @@ +--TEST-- +Tidy::diagnose() NULL pointer dereference +--SKIPIF-- +<?php if (!extension_loaded("tidy")) print "skip"; ?> +--FILE-- +<?php + +$nx = new Tidy("*"); +$nx->diagnose(); + +?> +--EXPECTF-- +Warning: tidy::__construct(): Cannot Load '*' into memory in %s on line %d Modified: php/php-src/trunk/ext/tidy/tidy.c =================================================================== --- php/php-src/trunk/ext/tidy/tidy.c 2011-11-15 14:20:13 UTC (rev 319253) +++ php/php-src/trunk/ext/tidy/tidy.c 2011-11-15 15:16:20 UTC (rev 319254) @@ -1336,7 +1336,7 @@ { TIDY_FETCH_OBJECT; - if (tidyRunDiagnostics(obj->ptdoc->doc) >= 0) { + if (tidyStatus(obj->ptdoc->doc) != 0 && tidyRunDiagnostics(obj->ptdoc->doc) >= 0) { tidy_doc_update_properties(obj TSRMLS_CC); RETURN_TRUE; }