Segmentation fault in html_entity_decode

php.internals

Kamesh Jayachandran

21 years ago
Hi All, The following script causes a segmentation fault in NetWare but not on Windows or Linux versions of php-5.0.3 <?php html_entity_decode('&ensp;', ENT_QUOTES, 'UTF-8'); ?> I can not attribute to NetWare instead I could see the defect in our ext/standard/html.c The cause seems to be the following arrays are accessed with a index that is beyond their size 1)ent_uni_spacing(Actual size is 22 but accessed with a index 22) 2)ent_uni_8592_9002(Actual size is 410 but accessed with a index 410. From the name it seems that 9002 is a valid index so we need to add one more NULL at the end) Either we should add one more entry to the ent_uni_spacing array or reduce our endchar in entity_map You can see the index with which this arrays are accessed by putting a printf("k - entity_map[j].basechar = %d\n", k - entity_map[j].basechar); in a for loop which is around line 898 in html.c version 1.97.2.1. With regards Kamesh Jayachandran

Moriyoshi Koizumi

21 years ago
Now fixed in CVS. Thanks for the good report. Moriyoshi On 2005/01/10, at 22:30, Kamesh Jayachandran wrote:

Kamesh Jayachandran

21 years ago
Hi Moriyoshi, Still ent_uni_8592_9002's actual size is 410 but accessed with a index 410. With regards Kamesh Jayachandran On Wed, 12 Jan 2005 05:51:01 +0900, "Moriyoshi Koizumi" <moriyoshi@at.wakwak.com> said:

Moriyoshi Koizumi

21 years ago
On 2005/01/12, at 16:31, Kamesh Jayachandran wrote:
> Hi Moriyoshi, > Still ent_uni_8592_9002's actual size is 410 but accessed with a index > 410.
Huh? I'm confident about it :) It's certainly 411.

Kamesh Jayachandran

21 years ago
Hi Moriyoshi, My mistake. I Thought you would have fixed these 2 in one commit and diffed the latest with earlier one version and found only one fix. Now things work fine. With regards Kamesh Jayachandran On Wed, 12 Jan 2005 17:27:06 +0900, "Moriyoshi Koizumi" <moriyoshi@at.wakwak.com> said: