- MFH & BFN

NEWS

@@ -12,6 +12,7 @@ PHP                                                                        NEWS
   (chsc at peytz dot dk, Felipe)
 - Fixed bug #46026 (bzip2.decompress/zlib.inflate filter tries to decompress
   after end of stream). (Keisial at gmail dot com, Greg)
+- Fixed buf #45722 (mb_check_encoding() crashes). (Moriyoshi)
 - Fixed bug #44251, #41125 (PDO + quote() + prepare() can result in segfault).
   (tsteiner at nerdclub dot net)
 - Fixed bug #42078 (pg_meta_data mix tables metadata from different schemas).

ext/mbstring/libmbfl/filters/mbfilter_htmlent.c

@@ -232,8 +232,7 @@ int mbfl_filt_conv_html_dec(int c, mbfl_convert_filter *filter)
 				mbfl_filt_conv_html_dec_flush(filter);
 				if (c=='&')
 				{
-					filter->status = 1;
-					buffer[0] = '&';
+					buffer[filter->status++] = '&';
 				}
 			}
 		}
@@ -244,17 +243,19 @@ int mbfl_filt_conv_html_dec(int c, mbfl_convert_filter *filter)
 int mbfl_filt_conv_html_dec_flush(mbfl_convert_filter *filter)
 {
 	int status, pos = 0;
-	char *buffer;
+	unsigned char *buffer;
+	int err = 0;
 
-	buffer = (char*)filter->opaque;
+	buffer = (unsigned char*)filter->opaque;
 	status = filter->status;
+	filter->status = 0;
 	/* flush fragments */
 	while (status--) {
-		CK((*filter->output_function)(buffer[pos++], filter->data));
+		int e = (*filter->output_function)(buffer[pos++], filter->data);
+		if (e != 0)
+			err = e;
 	}
-	filter->status = 0;
-	/*filter->buffer = 0; of cause NOT*/
-	return 0;
+	return err;
 }