Merge branch 'PHP-7.3' into PHP-7.4

cmb69 · cmb69 · commit bf8c6519fb7f · 2020-02-13T15:16:09.000+01:00
* PHP-7.3:
  Fix #77569: Write Acess Violation in DomImplementation
diff --git a/NEWS b/NEWS
@@ -17,6 +17,10 @@ PHP                                                                        NEWS
 - CURL:
   . Fixed bug #79019 (Copied cURL handles upload empty file). (cmb)
 
+- DOM:
+  . Fixed bug #77569: (Write Acess Violation in DomImplementation). (Nikita,
+    cmb)
+
 - PCRE:
   . Fixed bug #79188 (Memory corruption in preg_replace/preg_replace_callback
     and unicode). (Nikita)
diff --git a/ext/dom/document.c b/ext/dom/document.c
@@ -342,7 +342,7 @@ int dom_document_encoding_write(dom_object *obj, zval *newval)
 		return FAILURE;
 	}
 
-	handler = xmlFindCharEncodingHandler(Z_STRVAL_P(newval));
+	handler = xmlFindCharEncodingHandler(ZSTR_VAL(str));
 
     if (handler != NULL) {
 		xmlCharEncCloseFunc(handler);
diff --git a/ext/dom/tests/bug77569.phpt b/ext/dom/tests/bug77569.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #77569 (Write Acess Violation in DomImplementation)
+--SKIPIF--
+<?php
+if (!extension_loaded('dom')) die('skip dom extension not available');
+?>
+--FILE--
+<?php
+$imp = new DOMImplementation;
+$dom = $imp->createDocument("", "");
+$dom->encoding = null;
+?>
+--EXPECTF--
+Warning: main(): Invalid Document Encoding in %s on line %d

Original file line number	Diff line number	Diff line change
`@@ -342,7 +342,7 @@ int dom_document_encoding_write(dom_object obj, zval newval)`
`342`	`342`	`return FAILURE;`
`343`	`343`	`}`
`344`	`344`
`345`		`- handler = xmlFindCharEncodingHandler(Z_STRVAL_P(newval));`
	`345`	`+ handler = xmlFindCharEncodingHandler(ZSTR_VAL(str));`
`346`	`346`
`347`	`347`	`if (handler != NULL) {`
`348`	`348`	`xmlCharEncCloseFunc(handler);`