diff --git a/NEWS b/NEWS index 994cf589245..2e73298dc27 100644 --- a/NEWS +++ b/NEWS @@ -13,6 +13,9 @@ PHP NEWS - COM: . Fixed bug #62474 (com_event_sink crashes on certain arguments). (cmb) +- DOM: + . Fixed bug #80268 (loadHTML() truncates at NUL bytes). (cmb) + - IMAP: . Fixed bug #76618 (segfault on imap_reopen). (girgias) . Fixed bug #80239 (imap_rfc822_write_address() leaks memory). (cmb) diff --git a/ext/dom/document.c b/ext/dom/document.c index 23bdcae1e0c..c6d0f723f89 100644 --- a/ext/dom/document.c +++ b/ext/dom/document.c @@ -1840,7 +1840,6 @@ static void dom_load_html(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */ } ctxt = htmlCreateFileParserCtxt(source, NULL); } else { - source_len = xmlStrlen((xmlChar *) source); if (ZEND_SIZE_T_INT_OVFL(source_len)) { php_error_docref(NULL, E_WARNING, "Input string is too long"); RETURN_FALSE; diff --git a/ext/dom/tests/bug80268.phpt b/ext/dom/tests/bug80268.phpt new file mode 100644 index 00000000000..0fe50b85e86 --- /dev/null +++ b/ext/dom/tests/bug80268.phpt @@ -0,0 +1,24 @@ +--TEST-- +Bug #80268 (loadHTML() truncates at NUL bytes) +--SKIPIF-- + +--FILE-- +loadHTML("

foo\0bar

"); +$html = $doc->saveHTML(); +var_dump(strpos($html, '

foo

') !== false); + +file_put_contents(__DIR__ . '/80268.html', "

foo\0bar

"); +$doc = new DOMDocument; +$doc->loadHTMLFile(__DIR__ . '/80268.html'); +$html = $doc->saveHTML(); +var_dump(strpos($html, '

foo

') !== false); +?> +--CLEAN-- + +--EXPECT-- +bool(true) +bool(true)