Imported Upstream version 5.5.8+dfsgupstream/5.5.8+dfsg

2 files changed, 43 insertions, 2 deletions

diff --git a/ext/dom/document.c b/ext/dom/document.c
index efe6d9070..cca77ff9d 100644
--- a/ext/dom/document.c
+++ b/ext/dom/document.c
@@ -2304,7 +2304,7 @@ PHP_FUNCTION(dom_document_save_html)
 	xmlBufferPtr buf;
 	dom_object *intern, *nodeobj;
 	xmlChar *mem = NULL;
-	int size, format;
+	int size = 0, format;
 	dom_doc_propsptr doc_props;
 
 	if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(),
@@ -2332,7 +2332,22 @@ PHP_FUNCTION(dom_document_save_html)
 			RETURN_FALSE;
 		}
 		
-		size = htmlNodeDump(buf, docp, node);
+		if (node->type == XML_DOCUMENT_FRAG_NODE) {
+			int one_size;
+
+			for (node = node->children; node; node = node->next) {
+				one_size = htmlNodeDump(buf, docp, node);
+
+				if (one_size >= 0) {
+					size += one_size;
+				} else {
+					size = -1;
+					break;
+				}
+			}
+		} else {
+			size = htmlNodeDump(buf, docp, node);
+		}
 		if (size >= 0) {
 			mem = (xmlChar*) xmlBufferContent(buf);
 			if (!mem) {
diff --git a/ext/dom/tests/bug65196.phpt b/ext/dom/tests/bug65196.phpt
new file mode 100644
index 000000000..c77f97222
--- /dev/null
+++ b/ext/dom/tests/bug65196.phpt
@@ -0,0 +1,26 @@
+--TEST--
+bug #65196 (Passing DOMDocumentFragment to DOMDocument::saveHTML() Produces invalid Markup)
+--SKIPIF--
+<?php
+extension_loaded("dom") or die("skip need ext/dom");
+?>
+--FILE--
+<?php
+$dom = new DOMDocument();
+
+$frag1 = $dom->createDocumentFragment();
+var_dump($dom->saveHTML($frag1));
+
+$frag2 = $dom->createDocumentFragment();
+$div = $dom->createElement('div');
+$div->appendChild($dom->createElement('span'));
+$frag2->appendChild($div);
+$frag2->appendChild($dom->createElement('div'));
+$frag2->appendChild($dom->createElement('div'));
+var_dump($dom->saveHTML($frag2));
+?>
+===DONE===
+--EXPECT--
+string(0) ""
+string(46) "<div><span></span></div><div></div><div></div>"
+===DONE===