Fixed bug #26528 (HTML entities are not being decoded by

xml_parse()/xml_parse_into_struct()).

NEWS

@@ -26,6 +26,8 @@ PHP                                                                        NEWS
 - Fixed include_once() / require_once() on Windows to honor case-insensitivity
   of files. (Andi)
 - Fixed __autoload() to preserve case of the passed class name. (Andi)
+- Fixed bug #26528 (HTML entities are not being decoded by 
+  xml_parse()/xml_parse_into_struct()). (Ilia)
 - Fixed bug #26072 (--disable-libxml does not work). (Jani)
 - Fixed bug #26083 (Non-working write support in ext/dom). (Ilia)
 - Fixed bug #26001 (serialize crashes when accessing an overloaded object that 

ext/xml/compat.c

@@ -412,6 +412,7 @@ XML_ParserCreate_MM(const XML_Char *encoding, const XML_Memory_Handling_Suite *m
 	} else {
 		parser->parser->charset = XML_CHAR_ENCODING_NONE;
 	}
+	parser->parser->replaceEntities=1;
 	if (sep != NULL) {
 		parser->use_namespace = 1;
 		parser->_ns_map = xmlHashCreate(10);

ext/xml/tests/bug26528.phpt

@@ -0,0 +1,27 @@
+--TEST--
+Bug #26528 (HTML entities are not being decoded)
+--FILE--
+<?php
+	$sample = "<?xml version=\"1.0\"?><test attr=\"angle&lt;bracket\"/>";
+	$parser = xml_parser_create();
+	$res = xml_parse_into_struct($parser,$sample,$vals,$index);
+	xml_parser_free($parser);
+	var_dump($vals);
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  array(4) {
+    ["tag"]=>
+    string(4) "TEST"
+    ["type"]=>
+    string(8) "complete"
+    ["level"]=>
+    int(1)
+    ["attributes"]=>
+    array(1) {
+      ["ATTR"]=>
+      string(13) "angle<bracket"
+    }
+  }
+}