fix logic

Author: ArtUkrainskiy

ext/standard/html.c

@@ -860,12 +860,13 @@ static void traverse_for_entities(
 			entity_end_ptr = num_start;
 			if (process_numeric_entity(&entity_end_ptr, &code) == FAILURE) {
 				valid_entity = false;
-			} else if (!all && (code > 63U || stage3_table_be_apos_00000[code].data.ent.entity == NULL)) {
+			}
+            if (valid_entity && !all && (code > 63U || stage3_table_be_apos_00000[code].data.ent.entity == NULL)) {
 				/* If we're in htmlspecialchars_decode, we're only decoding entities
 				 * that represent &, <, >, " and '. Is this one of them? */
 				valid_entity = false;
-			} else if (!unicode_cp_is_allowed(code, doctype) ||
-						(doctype == ENT_HTML_DOC_HTML5 && code == 0x0D)) {
+			} else if (valid_entity && (!unicode_cp_is_allowed(code, doctype) ||
+						(doctype == ENT_HTML_DOC_HTML5 && code == 0x0D))) {
 				/* are we allowed to decode this entity in this document type?
 				 * HTML 5 is the only that has a character that cannot be used in
 				 * a numeric entity but is allowed literally (U+000D). The