MFH: fix leak and errmsg

add test

diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c
index a37b858a53a47688caf45ed38334325d89173fde..8787e542a1d3db48457af32813f92a97f17d60e0 100644 (file)
--- a/ext/simplexml/simplexml.c
+++ b/ext/simplexml/simplexml.c
@@ -515,7 +515,10 @@ static void sxe_prop_dim_write(zval *object, zval *member, zval *value, zend_boo
                                }
                                /* break is missing intentionally */
                        default:
-                               php_error_docref(NULL TSRMLS_CC, E_WARNING, "It is not yet possible to assign complex types to %s", attribs ? "attributes" : "properties");
+                               if (member == &tmp_zv) {
+                                       zval_dtor(&tmp_zv);
+                               }
+                               zend_error(E_WARNING, "It is not yet possible to assign complex types to %s", attribs ? "attributes" : "properties");
                                return;
                }
        }

diff --git a/ext/simplexml/tests/bug38406.phpt b/ext/simplexml/tests/bug38406.phpt
new file mode 100644 (file)
index 0000000..f439e33
--- /dev/null
+++ b/ext/simplexml/tests/bug38406.phpt
@@ -0,0 +1,33 @@
+--TEST--
+Bug #38406 (crash when assigning objects to SimpleXML attributes)
+--SKIPIF--
+<?php if (!extension_loaded("simplexml")) print "skip"; ?>
+--FILE--
+<?php
+
+$item = new SimpleXMLElement(b'<something />');
+$item->attribute = b'something';
+var_dump($item->attribute);
+
+$item->otherAttribute = $item->attribute;
+var_dump($item->otherAttribute);
+
+$a = array();
+$item->$a = new stdclass;
+
+echo "Done\n";
+?>
+--EXPECTF--    
+object(SimpleXMLElement)#%d (1) {
+  [0]=>
+  string(9) "something"
+}
+object(SimpleXMLElement)#%d (1) {
+  [0]=>
+  string(9) "something"
+}
+
+Notice: Array to string conversion in %s on line %d
+
+Warning: It is not yet possible to assign complex types to properties in %s on line %d
+Done