diff --git a/ext/xml/compat.c b/ext/xml/compat.c index 80e58fc9c2f6..23e5632cd002 100644 --- a/ext/xml/compat.c +++ b/ext/xml/compat.c @@ -78,11 +78,7 @@ _start_element_handler(void *user, const xmlChar *name, const xmlChar **attribut return; } - qualified_name = xmlStrdup(name); - - parser->h_start_element(parser->user, (const XML_Char *) qualified_name, (const XML_Char **) attributes); - - xmlFree(qualified_name); + parser->h_start_element(parser->user, name, (const XML_Char **) attributes); } static void diff --git a/ext/xml/tests/gh14637.phpt b/ext/xml/tests/gh14637.phpt new file mode 100644 index 000000000000..f987feb72ad7 --- /dev/null +++ b/ext/xml/tests/gh14637.phpt @@ -0,0 +1,34 @@ +--TEST-- +GH-14637 memory leak under memory limit +--EXTENSIONS-- +xml +--INI-- +memory_limit=20M +--CREDITS-- +YuanchengJiang +--FILE-- +<$long_text/><$long_text/>foo"; +$long_xml_tail = ""; +$parser = createParser(false); +$ret = xml_parse($parser, $long_xml_head, true); +echo "ret = $ret (", xml_error_string(xml_get_error_code($parser)), ")\n"; +$parser = createParser(true); +$ret = xml_parse($parser, $long_xml_head, false); +$parser = createParser(true); +$ret = xml_parse_into_struct($parser, $long_xml_head . $long_xml_tail, $values, $index); +?> +--EXPECTF-- +ret = 0 (XML_ERR_NAME_REQUIRED) + +Fatal error: Allowed memory size of %d bytes exhausted %s in %s on line %d