MFH: fix #41582 (SimpleXML crashes when accessing newly created element)

diff --git a/NEWS b/NEWS
index da73acef6c7189043ce04b1a83a204ebcb0b7e8f..4223d347dfb6e431ac9a58f101e105c8779d00ec 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -10,6 +10,8 @@ PHP                                                                        NEWS
   exists (pecl bug #11216) (Pierre)
   GD_RELEASE_VERSION, GD_EXTRA_VERSION and GD_VERSION_STRING. (Pierre)
 - Fixed bug #41594 (Statement cache is flushed too frequently). (Tony)
+- Fixed bug #41582 (SimpleXML crashes when accessing newly created element).
+  (Tony)
 - Fixed bug #41576 (configure failure when using --without-apxs or some
   other SAPIs disabling options). (Jani)
 - Fixed bug #41567 (json_encode() double conversion is inconsistent with

diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c
index dc5b6c898315efd971f4c2d7af8dea1377894916..4c0fdf11a2e55da8c40dd2c1b5b3a26f113d5a16 100644 (file)
--- a/ext/simplexml/simplexml.c
+++ b/ext/simplexml/simplexml.c
@@ -238,7 +238,7 @@ next_iter:
 
 /* {{{ sxe_prop_dim_read()
  */
-static zval * sxe_prop_dim_read(zval *object, zval *member, zend_bool elements, zend_bool attribs, zend_bool silent TSRMLS_DC)
+static zval * sxe_prop_dim_read(zval *object, zval *member, zend_bool elements, zend_bool attribs, int type TSRMLS_DC)
 {
        zval           *return_value;
        php_sxe_object *sxe;
@@ -249,6 +249,12 @@ static zval * sxe_prop_dim_read(zval *object, zval *member, zend_bool elements,
        int             nodendx = 0;
        int             test = 0;
 
+       if (!member) {
+               return_value = &EG(uninitialized_zval);
+               return_value->is_ref = 1;
+               return return_value;
+       }
+
        sxe = php_sxe_fetch_object(object TSRMLS_CC);
 
        if (Z_TYPE_P(member) == IS_LONG) {
@@ -357,7 +363,7 @@ static zval * sxe_prop_dim_read(zval *object, zval *member, zend_bool elements,
  */
 static zval * sxe_property_read(zval *object, zval *member, int type TSRMLS_DC)
 {
-       return sxe_prop_dim_read(object, member, 1, 0, type == BP_VAR_IS TSRMLS_CC);
+       return sxe_prop_dim_read(object, member, 1, 0, type TSRMLS_CC);
 }
 /* }}} */
 
@@ -365,7 +371,7 @@ static zval * sxe_property_read(zval *object, zval *member, int type TSRMLS_DC)
  */
 static zval * sxe_dimension_read(zval *object, zval *offset, int type TSRMLS_DC)
 {
-       return sxe_prop_dim_read(object, offset, 0, 1, 0 TSRMLS_CC);
+       return sxe_prop_dim_read(object, offset, 0, 1, type TSRMLS_CC);
 }
 /* }}} */
 

diff --git a/ext/simplexml/tests/bug41582.phpt b/ext/simplexml/tests/bug41582.phpt
new file mode 100644 (file)
index 0000000..5f0aa78
--- /dev/null
+++ b/ext/simplexml/tests/bug41582.phpt
@@ -0,0 +1,16 @@
+--TEST--
+Bug #41582 (SimpleXML crashes when accessing newly created element)
+--FILE--
+<?php
+
+$xml = new SimpleXMLElement('<?xml version="1.0" standalone="yes"?>
+<collection></collection>');
+
+$xml->movie[]->characters->character[0]->name = 'Miss Coder';
+
+var_dump($xml->asXml());
+
+echo "Done\n";
+?>
+--EXPECTF--    
+Fatal error: Cannot use object of type stdClass as array in %s on line %d