mirror of
https://github.com/php/php-src.git
synced 2024-09-22 02:17:32 +00:00
e878b9f390
libxml doesn't do reference counting inside its node types. It's possible to remove an entity declaration out of the document, but then entity references will keep pointing to that stale declaration. This will cause crashes. One idea would be to check when a declaration is removed, to trigger a hook that updates all references. However this means we have to keep track of all references somehow, which would be a high-overhead solution. The solution in this patch makes sure that the fields are always updated before they are read. Closes GH-14089.
42 lines
624 B
PHP
42 lines
624 B
PHP
--TEST--
|
|
Entity references with stale entity declaration 01
|
|
--EXTENSIONS--
|
|
dom
|
|
--FILE--
|
|
<?php
|
|
|
|
$dom = new DOMDocument;
|
|
$dom->loadXML(<<<XML
|
|
<!DOCTYPE foo [
|
|
<!ENTITY foo "bar">
|
|
]>
|
|
<foo>&foo;</foo>
|
|
XML);
|
|
|
|
$ref = $dom->documentElement->firstChild;
|
|
$decl = $ref->firstChild;
|
|
|
|
$nodes = $ref->childNodes;
|
|
$dom->removeChild($dom->doctype);
|
|
unset($decl);
|
|
|
|
var_dump($nodes);
|
|
var_dump($ref->firstChild);
|
|
var_dump($ref->lastChild);
|
|
var_dump($ref->textContent);
|
|
var_dump($ref->childNodes);
|
|
|
|
?>
|
|
--EXPECT--
|
|
object(DOMNodeList)#4 (1) {
|
|
["length"]=>
|
|
int(0)
|
|
}
|
|
NULL
|
|
NULL
|
|
string(0) ""
|
|
object(DOMNodeList)#2 (1) {
|
|
["length"]=>
|
|
int(0)
|
|
}
|