fix bug #38424 (Different attribute assignment if new or existing)

add test

diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c
index d106276fedc29e4f93f5d8fb479a35f1dc61db9b..21a6c91ebc1aad9a705bef7d6ecf1029cbeb65a2 100644 (file)
--- a/ext/simplexml/simplexml.c
+++ b/ext/simplexml/simplexml.c
@@ -366,6 +366,8 @@ static zval * sxe_dimension_read(zval *object, zval *offset, int type TSRMLS_DC)
 static void change_node_zval(xmlNodePtr node, zval *value TSRMLS_DC)
 {
        zval value_copy;
+       xmlChar *buffer;
+       int buffer_len;
 
        if (!value)
        {
@@ -385,7 +387,20 @@ static void change_node_zval(xmlNodePtr node, zval *value TSRMLS_DC)
                        convert_to_string(value);
                        /* break missing intentionally */
                case IS_STRING:
-                       xmlNodeSetContentLen(node, (xmlChar *)Z_STRVAL_P(value), Z_STRLEN_P(value));
+                       if (node->type == XML_ATTRIBUTE_NODE) {
+                               buffer = xmlEncodeEntitiesReentrant(node->doc, (xmlChar *)Z_STRVAL_P(value));
+                               buffer_len = xmlStrlen(buffer);
+                       } else {
+                               buffer = (xmlChar *)Z_STRVAL_P(value);
+                               buffer_len = Z_STRLEN_P(value);
+                       }
+                       /* check for NULL buffer in case of memory error in xmlEncodeEntitiesReentrant */
+                       if (buffer) {
+                               xmlNodeSetContentLen(node, buffer, buffer_len);
+                               if (node->type == XML_ATTRIBUTE_NODE) {
+                                       xmlFree(buffer);
+                               }
+                       }
                        if (value == &value_copy) {
                                zval_dtor(value);
                        }

diff --git a/ext/simplexml/tests/bug38424.phpt b/ext/simplexml/tests/bug38424.phpt
new file mode 100644 (file)
index 0000000..baab45f
--- /dev/null
+++ b/ext/simplexml/tests/bug38424.phpt
@@ -0,0 +1,26 @@
+--TEST--
+Bug #38424 (Different attribute assignment if new or exists)
+--SKIPIF--
+<?php if (!extension_loaded("simplexml")) print "skip"; ?>
+--FILE--
+<?php
+
+$xml = simplexml_load_string('<xml></xml>');
+
+$str = "abc & def" ;
+
+$xml["a1"] = "" ;
+$xml["a1"] = htmlspecialchars($str,ENT_NOQUOTES) ;
+
+$xml["a2"] = htmlspecialchars($str,ENT_NOQUOTES) ;
+
+$xml["a3"] = "" ;
+$xml["a3"] = $str ;
+
+$xml["a4"] = $str ;
+
+echo $xml->asXML();
+?>
+--EXPECT--     
+<?xml version="1.0"?>
+<xml a1="abc &amp;amp; def" a2="abc &amp;amp; def" a3="abc &amp; def" a4="abc &amp; def"/>