Fix phpGH-15570: Segmentation fault (access null pointer) in ext/dom/html5_serializer.c

nielsdos · nielsdos · commit 690ce6d5d4c9 · 2024-08-25T15:09:30.000+02:00
Closes phpGH-15572.
diff --git a/NEWS b/NEWS
@@ -24,6 +24,8 @@ PHP                                                                        NEWS
 - DOM:
   . Fixed bug GH-15551 (Segmentation fault (access null pointer) in
     ext/dom/xml_common.h). (nielsdos)
+  . Fixed bug GH-15570 (Segmentation fault (access null pointer) in
+    ext/dom/html5_serializer.c). (nielsdos)
 
 - FPM:
   . Added memory peak to the scoreboard / status page. (Flávio Heleno)
diff --git a/ext/dom/html5_serializer.c b/ext/dom/html5_serializer.c
@@ -137,8 +137,8 @@ static zend_result dom_html5_serialize_text_node(dom_html5_serialize_context *ct
 		return SUCCESS;
 	}
 
-	if (node->parent->type == XML_ELEMENT_NODE && php_dom_ns_is_fast(node->parent, php_dom_ns_is_html_magic_token)) {
-		const xmlNode *parent = node->parent;
+	const xmlNode *parent = node->parent;
+	if (parent != NULL && parent->type == XML_ELEMENT_NODE && php_dom_ns_is_fast(parent, php_dom_ns_is_html_magic_token)) {
 		size_t name_length = strlen((const char *) parent->name);
 		/* Spec tells us to only emit noscript content as-is if scripting is enabled.
 		 * However, the user agent (PHP) does not support (JS) scripting.
diff --git a/ext/dom/tests/gh15570.phpt b/ext/dom/tests/gh15570.phpt
@@ -0,0 +1,19 @@
+--TEST--
+GH-15570 (Segmentation fault (access null pointer) in ext/dom/html5_serializer.c)
+--CREDITS--
+YuanchengJiang
+--EXTENSIONS--
+dom
+--FILE--
+<?php
+$html = <<<HTML
+<head>
+</html>
+HTML;
+$dom = Dom\HTMLDocument::createFromString($html, LIBXML_NOERROR);
+$a = $dom->head->firstChild->cloneNode(false);
+var_dump($dom->saveHTML($a));
+?>
+--EXPECT--
+string(1) "
+"
