Fixed bug #38438 (DOMNodeList->item(0) segfault on empty NodeList)

diff --git a/NEWS b/NEWS
index 37ff4420e0db48899740780f2b6e6e3eea20aacc..cb8115c1edc4b61965e47dbc56dd8cffcb6d008a 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -37,6 +37,7 @@ PHP                                                                        NEWS
 - Fixed phpinfo() cutoff of variables at \0. (Ilia)
 - Fixed a bug in the filter extension that prevented magic_quotes_gpc from
   being applied when RAW filter is used. (Ilia)
+- FixedbBug #38438 (DOMNodeList->item(0) segfault on empty NodeList). (Ilia)
 - Fixed bug #38431 (xmlrpc_get_type() crashes PHP on objects). (Tony)
 - Fixed bug #38394 (PDO fails to recover from failed prepared statement
   execution). (Ilia)
@@ -45,7 +46,7 @@ PHP                                                                        NEWS
 - Fixed bug #38354 (Unwanted reformatting of XML when using AsXML). (Christian)
 - Fixed bug #38347 (Segmentation fault when using foreach with an unknown/empty 
   SimpleXMLElement). (Tony)
-- Fixed bug #38322 (reading past array in sscanf() leads to arbitary code 
+- Fixed bug #38322 (reading past array in sscanf() leads to arbitrary code 
   execution). (Tony)
 - Fixed bug #38303 (spl_autoload_register() supress all errors silently).
   (Ilia)

diff --git a/ext/dom/nodelist.c b/ext/dom/nodelist.c
index 8989f907ad9e9af5d5dce4b273432fcb266a0023..268879bc1655ab1954f383f78f7d3fcb67fb8270 100644 (file)
--- a/ext/dom/nodelist.c
+++ b/ext/dom/nodelist.c
@@ -134,7 +134,7 @@ PHP_FUNCTION(dom_nodelist_item)
                                                zval_copy_ctor(return_value);
                                                return;
                                        }
-                               } else {
+                               } else if (objmap->baseobj) {
                                        nodep = dom_object_get_node(objmap->baseobj);
                                        if (nodep) {
                                                if (objmap->nodetype == XML_ATTRIBUTE_NODE || objmap->nodetype == XML_ELEMENT_NODE) {

diff --git a/ext/dom/tests/bug38438.phpt b/ext/dom/tests/bug38438.phpt
new file mode 100644 (file)
index 0000000..f512528
--- /dev/null
+++ b/ext/dom/tests/bug38438.phpt
@@ -0,0 +1,13 @@
+--TEST--
+Bug #38438 (DOMNodeList->item(0) segfault on empty NodeList)
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+$list = new DOMNodeList();
+var_dump($list->item(0));
+echo "OK\n";
+?>
+--EXPECT--
+NULL
+OK