Prevent SimpleXML from silently modifying types of variables that are

assigned to its objects.

Implementation notes for overloaded object modules:

- If you return a zval which is not otherwise referenced by the extension
  or the engine's symbol table, its reference count should be 0.
- If you receive a value zval in write_property/write_dimension, you
  may only modify it if its reference count is 1.  Otherwise, you must
  create a copy of that zval before making any changes.  You should NOT
  modify the reference count of the value passed to you.

Have fun!

diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c
index acf547b960501b986bbfa87a6b03c5297c807ae7..3615a82ff518789ca74d5afd448973a62d0c9784 100644 (file)
--- a/ext/simplexml/simplexml.c
+++ b/ext/simplexml/simplexml.c
@@ -274,14 +274,25 @@ static zval * sxe_dimension_read(zval *object, zval *offset, int type TSRMLS_DC)
 static void
 change_node_zval(xmlNodePtr node, zval *value)
 {
+       zval value_copy;
+
        switch (Z_TYPE_P(value)) {
                case IS_LONG:
                case IS_BOOL:
                case IS_DOUBLE:
                case IS_NULL:
+                       if (value->refcount > 1) {
+                               value_copy = *value;
+                               zval_copy_ctor(&value_copy);
+                               value = &value_copy;
+                       }
                        convert_to_string(value);
+                       /* break missing intentionally */
                case IS_STRING:
                        xmlNodeSetContentLen(node, Z_STRVAL_P(value), Z_STRLEN_P(value));
+                       if (value == &value_copy) {
+                               zval_dtor(value);
+                       }
                        break;
                default:
                        php_error(E_WARNING, "It is not possible to assign complex types to nodes");