fix #38406 (crash when assigning objects to SimpleXML attributes)

diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c
index 9d4385a3ae8daa2f6c427ae509f7509c5454b299..079728e35749c7198b95845f73cf8504c4912846 100644 (file)
--- a/ext/simplexml/simplexml.c
+++ b/ext/simplexml/simplexml.c
@@ -56,6 +56,7 @@ static php_sxe_object* php_sxe_object_new(zend_class_entry *ce TSRMLS_DC);
 static zend_object_value php_sxe_register_object(php_sxe_object * TSRMLS_DC);
 static xmlNodePtr php_sxe_reset_iterator(php_sxe_object *sxe, int use_data TSRMLS_DC);
 static xmlNodePtr php_sxe_iterator_fetch(php_sxe_object *sxe, xmlNodePtr node, int use_data TSRMLS_DC);
+static zval *sxe_get_value(zval *z TSRMLS_DC);
 
 /* {{{ _node_as_zval()
  */
@@ -428,6 +429,7 @@ static void sxe_prop_dim_write(zval *object, zval *member, zval *value, zend_boo
        int             is_attr = 0;
        int                             nodendx = 0;
        int             test = 0;
+       int                             new_value = 0;
        long            cnt;
        zval            tmp_zv, trim_zv, value_copy;
 
@@ -506,8 +508,17 @@ static void sxe_prop_dim_write(zval *object, zval *member, zval *value, zend_boo
                                break;
                        case IS_STRING:
                                break;
+                       case IS_OBJECT:
+                               if (Z_OBJCE_P(value) == sxe_class_entry) {
+                                       value = sxe_get_value(value TSRMLS_CC);
+                                       INIT_PZVAL(value);
+                                       new_value = 1;
+                                       break;
+                               }
+                               /* break is missing intentionally */
                        default:
                                php_error_docref(NULL TSRMLS_CC, E_WARNING, "It is not yet possible to assign complex types to %s", attribs ? "attributes" : "properties");
+                               return;
                }
        }
 
@@ -596,6 +607,9 @@ next_iter:
        if (value && value == &value_copy) {
                zval_dtor(value);
        }
+       if (new_value) {
+               zval_ptr_dtor(&value);
+       }
 }
 /* }}} */