Re: segfault in html_entity_decode

On Wed, May 11, 2005 at 04:18:40AM -0700, Kamesh Jayachandran wrote: > Hi Derick and Joe, > > html_entity_decode('&ensp;&thinsp;&lsquo;&dagger;&prime;&frasl;&euro;', > ENT_QUOTES, 'UTF-8'); (same testcase bug #29119) is causing Segfault in > NetWare. > > The cause of the segfault seems to be the size of ent_uni_338_402. Which > I persume should be of size 402-338+1=65 > > It used to be 63 in size till 1.97.2.5. > > Bug fix 28067 by Derick seemed to have increased the size by 65 but with > wrong comment ending. > It resulted in the code as follows, > /* 376 (0x0178) <Caution>No end comment</Caution> > "Yuml", NULL, NULL, NULL, NULL, NULL, NULL, NULL, > NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, > NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, > /* 400 (0x0190)*/ > NULL, NULL, "fnof" > > Later Joe Orton fixed the above improper comment by extending the > comment to 3 more lines. The comment already extended for the full three lines since it wasn't terminated earlier. But I guess *that* was the mistake made in the merge from the 4.3, and it was supposed to match the 4.3 code as below, does this fix the segfault for you? Index: html.c =================================================================== RCS file: /repository/php-src/ext/standard/html.c,v retrieving revision 1.107 diff -u -r1.107 html.c --- html.c 1 May 2005 19:48:55 -0000 1.107 +++ html.c 11 May 2005 11:56:29 -0000 @@ -115,11 +115,11 @@ "Scaron", "scaron", NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, - /* 376 (0x0178) + /* 376 (0x0178) */ "Yuml", NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, */ - /* 400 (0x0190)*/ + /* 400 (0x0190) */ NULL, NULL, "fnof" };