fix #36611 (assignment to SimpleXML object attribute changes argument type to string)

diff --git a/NEWS b/NEWS
index c9e0466434e9d191bdd26a2950173aee22f53fd2..2d123abd65a2cb490d796753b1f75833a202b9be 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -36,6 +36,8 @@ PHP                                                                        NEWS
 - Fixed tiger hash algorithm generating wrong results on big endian platforms.
   (Mike)
 - Fixed crash with DOMImplementation::createDocumentType("name:"). (Mike)
+- Fixed bug #36611 (assignment to SimpleXML object attribute changes argument 
+  type to string). (Tony)
 - Fixed bug #36606 (pg_query_params() changes arguments type to string). (Tony)
 - Fixed bug #36599 (DATE_W3C format constant incorrect). (Derick)
 - Fixed bug #36575 (SOAP: Incorrect complex type instantiation with

diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c
index 8a321ce0baaaf2f84cd556e37413c2613e073e53..9ba15041886bd8aa25649ce1bd34408427090517 100644 (file)
--- a/ext/simplexml/simplexml.c
+++ b/ext/simplexml/simplexml.c
@@ -408,7 +408,7 @@ static void sxe_prop_dim_write(zval *object, zval *member, zval *value, zend_boo
        int                             nodendx = 0;
        int             test = 0;
        long            cnt;
-       zval            tmp_zv, trim_zv;
+       zval            tmp_zv, trim_zv, value_copy;
 
        if (!member) {
                /* This happens when the user did: $sxe[] = $value
@@ -475,6 +475,11 @@ static void sxe_prop_dim_write(zval *object, zval *member, zval *value, zend_boo
                        case IS_BOOL:
                        case IS_DOUBLE:
                        case IS_NULL:
+                               if (value->refcount > 1) {
+                                       value_copy = *value;
+                                       zval_copy_ctor(&value_copy);
+                                       value = &value_copy;
+                               }
                                convert_to_string(value);
                                break;
                        case IS_STRING:
@@ -566,6 +571,9 @@ next_iter:
        if (pnewnode) {
                *pnewnode = newnode;
        }
+       if (value && value == &value_copy) {
+               zval_dtor(value);
+       }
 }
 /* }}} */