fix #41582 (SimpleXML crashes when accessing newly created element)

diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c
index 3fb12d59e89e6f725326cd2d978b938088e07f3c..0c420c603a8d007e427abc479e4d70e50a35470a 100644 (file)
--- a/ext/simplexml/simplexml.c
+++ b/ext/simplexml/simplexml.c
@@ -238,7 +238,7 @@ next_iter:
 
 /* {{{ sxe_prop_dim_read()
  */
-static zval * sxe_prop_dim_read(zval *object, zval *member, zend_bool elements, zend_bool attribs, zend_bool silent TSRMLS_DC)
+static zval * sxe_prop_dim_read(zval *object, zval *member, zend_bool elements, zend_bool attribs, int type TSRMLS_DC)
 {
        zval           *return_value;
        php_sxe_object *sxe;
@@ -249,6 +249,12 @@ static zval * sxe_prop_dim_read(zval *object, zval *member, zend_bool elements,
        int             nodendx = 0;
        int             test = 0;
 
+       if (!member) {
+               return_value = &EG(uninitialized_zval);
+               return_value->is_ref = 1;
+               return return_value;
+       }
+
        sxe = php_sxe_fetch_object(object TSRMLS_CC);
 
        if (Z_TYPE_P(member) == IS_LONG) {
@@ -357,7 +363,7 @@ static zval * sxe_prop_dim_read(zval *object, zval *member, zend_bool elements,
  */
 static zval * sxe_property_read(zval *object, zval *member, int type TSRMLS_DC)
 {
-       return sxe_prop_dim_read(object, member, 1, 0, type == BP_VAR_IS TSRMLS_CC);
+       return sxe_prop_dim_read(object, member, 1, 0, type TSRMLS_CC);
 }
 /* }}} */
 
@@ -365,7 +371,7 @@ static zval * sxe_property_read(zval *object, zval *member, int type TSRMLS_DC)
  */
 static zval * sxe_dimension_read(zval *object, zval *offset, int type TSRMLS_DC)
 {
-       return sxe_prop_dim_read(object, offset, 0, 1, 0 TSRMLS_CC);
+       return sxe_prop_dim_read(object, offset, 0, 1, type TSRMLS_CC);
 }
 /* }}} */
 

diff --git a/ext/simplexml/tests/bug41582.phpt b/ext/simplexml/tests/bug41582.phpt
new file mode 100644 (file)
index 0000000..e6e3648
--- /dev/null
+++ b/ext/simplexml/tests/bug41582.phpt
@@ -0,0 +1,15 @@
+--TEST--
+Bug #41582 (SimpleXML crashes when accessing newly created element)
+--FILE--
+<?php
+
+$xml = new SimpleXMLElement(b'<?xml version="1.0" standalone="yes"?><collection></collection>');
+
+$xml->movie[]->characters->character[0]->name = b'Miss Coder';
+
+var_dump($xml->asXml());
+
+echo "Done\n";
+?>
+--EXPECTF--    
+Fatal error: Cannot use object of type stdClass as array in %s on line %d