fix #38347 (Segmentation fault when using foreach with an unknown/empty SimpleXMLElement)

diff --git a/ext/libxml/libxml.c b/ext/libxml/libxml.c
index 6c9d37fc134ae96dcb0e28003bc076fdb0139d8c..6163e559bdf8d84db787363f7f951ef01712ffd5 100644 (file)
--- a/ext/libxml/libxml.c
+++ b/ext/libxml/libxml.c
@@ -976,8 +976,8 @@ int php_libxml_decrement_doc_ref(php_libxml_node_object *object TSRMLS_DC) {
                                efree(object->document->doc_props);
                        }
                        efree(object->document);
+                       object->document = NULL;
                }
-               object->document = NULL;
        }
 
        return ret_refcount;
@@ -1035,6 +1035,8 @@ void php_libxml_node_decrement_resource(php_libxml_node_object *object TSRMLS_DC
                                obj_node->_private = NULL;
                        }
                }
+       }
+       if (object != NULL && object->document != NULL) {
                /* Safe to call as if the resource were freed then doc pointer is NULL */
                php_libxml_decrement_doc_ref(object TSRMLS_CC);
        }

diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c
index 153825a54856fafedf5338bd438221b37450e982..2afaa4955355f740d5a4be8eec2c56446baaf4b5 100644 (file)
--- a/ext/simplexml/simplexml.c
+++ b/ext/simplexml/simplexml.c
@@ -195,6 +195,9 @@ static xmlNodePtr sxe_get_element_by_name(php_sxe_object *sxe, xmlNodePtr node,
 
        if (sxe->iter.type == SXE_ITER_ELEMENT) {
                orgnode = sxe_find_element_by_name(sxe, node, sxe->iter.name TSRMLS_CC);
+               if (!orgnode) {
+                       return NULL;
+               }
                node = orgnode->children;
        }
 

diff --git a/ext/simplexml/tests/bug38347.phpt b/ext/simplexml/tests/bug38347.phpt
new file mode 100644 (file)
index 0000000..1dfad4d
--- /dev/null
+++ b/ext/simplexml/tests/bug38347.phpt
@@ -0,0 +1,35 @@
+--TEST--
+Bug #38347 (Segmentation fault when using foreach with an unknown/empty SimpleXMLElement)
+--SKIPIF--
+<?php if (!extension_loaded("simplexml")) print "skip"; ?>
+--FILE--
+<?php
+
+function iterate($xml)
+{
+    print_r($xml);
+    foreach ($xml->item as $item) {
+        echo "This code will crash!";
+    }
+}
+
+$xmlstr = "<xml><item>Item 1</item><item>Item 2</item></xml>";
+$xml = simplexml_load_string($xmlstr);
+iterate($xml->unknown);
+
+echo "Done\n";
+?>
+--EXPECTF--    
+SimpleXMLElement Object
+(
+)
+
+Warning: iterate(): Node no longer exists in %s on line %d
+Done
+--UEXPECTF--
+SimpleXMLElement Object
+(
+)
+
+Warning: iterate(): Node no longer exists in %s on line %d
+Done