felipe                                   Tue, 15 Nov 2011 15:16:20 +0000

Revision: http://svn.php.net/viewvc?view=revision&revision=319254

Log:
- Fixed bug #54682 (Tidy::diagnose() NULL pointer dereference)

Bug: https://bugs.php.net/54682 (Open) tidy NullPD
      
Changed paths:
    U   php/php-src/branches/PHP_5_3/NEWS
    A   php/php-src/branches/PHP_5_3/ext/tidy/tests/bug54682.phpt
    U   php/php-src/branches/PHP_5_3/ext/tidy/tidy.c
    U   php/php-src/branches/PHP_5_4/NEWS
    A   php/php-src/branches/PHP_5_4/ext/tidy/tests/bug54682.phpt
    U   php/php-src/branches/PHP_5_4/ext/tidy/tidy.c
    A   php/php-src/trunk/ext/tidy/tests/bug54682.phpt
    U   php/php-src/trunk/ext/tidy/tidy.c

Modified: php/php-src/branches/PHP_5_3/NEWS
===================================================================
--- php/php-src/branches/PHP_5_3/NEWS   2011-11-15 14:20:13 UTC (rev 319253)
+++ php/php-src/branches/PHP_5_3/NEWS   2011-11-15 15:16:20 UTC (rev 319254)
@@ -27,6 +27,10 @@

 - SOAP
   . Fixed bug #44686 (SOAP-ERROR: Parsing WSDL with references). (Dmitry)
+
+- Tidy:
+  . Fixed bug #54682 (Tidy::diagnose() NULL pointer dereference).
+    (Maksymilian Arciemowicz, Felipe)

 03 Nov 2011, PHP 5.3.9RC1


Added: php/php-src/branches/PHP_5_3/ext/tidy/tests/bug54682.phpt
===================================================================
--- php/php-src/branches/PHP_5_3/ext/tidy/tests/bug54682.phpt                   
        (rev 0)
+++ php/php-src/branches/PHP_5_3/ext/tidy/tests/bug54682.phpt   2011-11-15 
15:16:20 UTC (rev 319254)
@@ -0,0 +1,13 @@
+--TEST--
+Tidy::diagnose() NULL pointer dereference
+--SKIPIF--
+<?php if (!extension_loaded("tidy")) print "skip"; ?>
+--FILE--
+<?php
+
+$nx = new Tidy("*");
+$nx->diagnose();
+
+?>
+--EXPECTF--
+Warning: tidy::__construct(): Cannot Load '*' into memory in %s on line %d

Modified: php/php-src/branches/PHP_5_3/ext/tidy/tidy.c
===================================================================
--- php/php-src/branches/PHP_5_3/ext/tidy/tidy.c        2011-11-15 14:20:13 UTC 
(rev 319253)
+++ php/php-src/branches/PHP_5_3/ext/tidy/tidy.c        2011-11-15 15:16:20 UTC 
(rev 319254)
@@ -1288,7 +1288,7 @@
 {
        TIDY_FETCH_OBJECT;

-       if (tidyRunDiagnostics(obj->ptdoc->doc) >= 0) {
+       if (tidyStatus(obj->ptdoc->doc) != 0 && 
tidyRunDiagnostics(obj->ptdoc->doc) >= 0) {
                tidy_doc_update_properties(obj TSRMLS_CC);
                RETURN_TRUE;
        }

Modified: php/php-src/branches/PHP_5_4/NEWS
===================================================================
--- php/php-src/branches/PHP_5_4/NEWS   2011-11-15 14:20:13 UTC (rev 319253)
+++ php/php-src/branches/PHP_5_4/NEWS   2011-11-15 15:16:20 UTC (rev 319254)
@@ -18,6 +18,10 @@
 - Output:
   . Fixed bug #60282 (Segfault when using ob_gzhandler() with open buffers).
     (Laruence)
+
+- Tidy:
+  . Fixed bug #54682 (Tidy::diagnose() NULL pointer dereference).
+    (Maksymilian Arciemowicz, Felipe)

 -CLI SAPI:
   . Fixed bug #60159 (Router returns false, but POST is not passed to requested

Added: php/php-src/branches/PHP_5_4/ext/tidy/tests/bug54682.phpt
===================================================================
--- php/php-src/branches/PHP_5_4/ext/tidy/tests/bug54682.phpt                   
        (rev 0)
+++ php/php-src/branches/PHP_5_4/ext/tidy/tests/bug54682.phpt   2011-11-15 
15:16:20 UTC (rev 319254)
@@ -0,0 +1,13 @@
+--TEST--
+Tidy::diagnose() NULL pointer dereference
+--SKIPIF--
+<?php if (!extension_loaded("tidy")) print "skip"; ?>
+--FILE--
+<?php
+
+$nx = new Tidy("*");
+$nx->diagnose();
+
+?>
+--EXPECTF--
+Warning: tidy::__construct(): Cannot Load '*' into memory in %s on line %d

Modified: php/php-src/branches/PHP_5_4/ext/tidy/tidy.c
===================================================================
--- php/php-src/branches/PHP_5_4/ext/tidy/tidy.c        2011-11-15 14:20:13 UTC 
(rev 319253)
+++ php/php-src/branches/PHP_5_4/ext/tidy/tidy.c        2011-11-15 15:16:20 UTC 
(rev 319254)
@@ -1336,7 +1336,7 @@
 {
        TIDY_FETCH_OBJECT;

-       if (tidyRunDiagnostics(obj->ptdoc->doc) >= 0) {
+       if (tidyStatus(obj->ptdoc->doc) != 0 && 
tidyRunDiagnostics(obj->ptdoc->doc) >= 0) {
                tidy_doc_update_properties(obj TSRMLS_CC);
                RETURN_TRUE;
        }

Added: php/php-src/trunk/ext/tidy/tests/bug54682.phpt
===================================================================
--- php/php-src/trunk/ext/tidy/tests/bug54682.phpt                              
(rev 0)
+++ php/php-src/trunk/ext/tidy/tests/bug54682.phpt      2011-11-15 15:16:20 UTC 
(rev 319254)
@@ -0,0 +1,13 @@
+--TEST--
+Tidy::diagnose() NULL pointer dereference
+--SKIPIF--
+<?php if (!extension_loaded("tidy")) print "skip"; ?>
+--FILE--
+<?php
+
+$nx = new Tidy("*");
+$nx->diagnose();
+
+?>
+--EXPECTF--
+Warning: tidy::__construct(): Cannot Load '*' into memory in %s on line %d

Modified: php/php-src/trunk/ext/tidy/tidy.c
===================================================================
--- php/php-src/trunk/ext/tidy/tidy.c   2011-11-15 14:20:13 UTC (rev 319253)
+++ php/php-src/trunk/ext/tidy/tidy.c   2011-11-15 15:16:20 UTC (rev 319254)
@@ -1336,7 +1336,7 @@
 {
        TIDY_FETCH_OBJECT;

-       if (tidyRunDiagnostics(obj->ptdoc->doc) >= 0) {
+       if (tidyStatus(obj->ptdoc->doc) != 0 && 
tidyRunDiagnostics(obj->ptdoc->doc) >= 0) {
                tidy_doc_update_properties(obj TSRMLS_CC);
                RETURN_TRUE;
        }

-- 
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

Reply via email to