Fix #78025: segfault when accessing properties of DOMDocumentType

cmb69 · cmb69 · commit e246dea9fe4d · 2019-05-17T13:31:18.000+02:00
Instead of following the NULL pointer, we return an empty string.
diff --git a/NEWS b/NEWS
@@ -6,6 +6,10 @@ PHP                                                                        NEWS
   . Fixed bug #76980 (Interface gets skipped if autoloader throws an exception).
     (Nikita)
 
+- DOM:
+  . Fixed bug #78025 (segfault when accessing properties of DOMDocumentType).
+    (cmb)
+
 30 May 2019, PHP 7.2.19
 
 - FPM:
diff --git a/ext/dom/documenttype.c b/ext/dom/documenttype.c
@@ -52,7 +52,7 @@ int dom_documenttype_name_read(dom_object *obj, zval *retval)
 		return FAILURE;
 	}
 
-	ZVAL_STRING(retval, (char *) (dtdptr->name));
+	ZVAL_STRING(retval, dtdptr->name ? (char *) (dtdptr->name) : "");
 
 	return SUCCESS;
 }
diff --git a/ext/dom/tests/bug78025.phpt b/ext/dom/tests/bug78025.phpt
@@ -0,0 +1,18 @@
+--TEST--
+Bug #78025 (segfault when accessing properties of DOMDocumentType)
+--SKIPIF--
+<?php
+if (!extension_loaded('dom')) die('skip dom extension not available');
+?>
+--FILE--
+<?php
+$htm = "<!DOCTYPE><html></html>";
+$dom = new DOMDocument;
+$dom->loadHTML($htm);
+var_dump($dom->doctype->name);
+?>
+===DONE===
+--EXPECTF--
+Warning: DOMDocument::loadHTML(): htmlParseDocTypeDecl : no DOCTYPE name ! in Entity, line: 1 in %s on line %d
+string(0) ""
+===DONE===

Original file line number	Diff line number	Diff line change
`@@ -52,7 +52,7 @@ int dom_documenttype_name_read(dom_object obj, zval retval)`
`52`	`52`	`return FAILURE;`
`53`	`53`	`}`
`54`	`54`
`55`		`- ZVAL_STRING(retval, (char *) (dtdptr->name));`
	`55`	`+ ZVAL_STRING(retval, dtdptr->name ? (char *) (dtdptr->name) : "");`
`56`	`56`
`57`	`57`	`return SUCCESS;`
`58`	`58`	`}`