MFH: fix #38406 (crash when assigning objects to SimpleXML attributes)

diff --git a/NEWS b/NEWS
index 007cf5a622595e4d96929edcb668de00339b0e2e..12e0cce8b0a487a7cee6c7d7b34fc7f04ae130db 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -39,6 +39,7 @@ PHP                                                                        NEWS
 - Fixed bug #40109 (iptcembed fails on non-jfif jpegs). (Tony)
 - Fixed bug #39836 (SplObjectStorage empty after unserialize). (Marcus)
 - Fixed bug #39322 (proc_terminate() destroys process resource). (Nuno)
+- Fixed bug #38406 (crash when assigning objects to SimpleXML attributes). (Tony)
 - Fixed bug #37799 (ftp_ssl_connect() falls back to non-ssl connection). (Nuno)
 - Fixed bug #36496 (SSL support in imap_open() not working on Windows). (Edin)
 - Fixed bug #34794 (proc_close() hangs when used with two processes).

diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c
index 603d1c5f8af433c4cf23c4e435ecaaa5fa82d008..a37b858a53a47688caf45ed38334325d89173fde 100644 (file)
--- a/ext/simplexml/simplexml.c
+++ b/ext/simplexml/simplexml.c
@@ -56,6 +56,7 @@ static php_sxe_object* php_sxe_object_new(zend_class_entry *ce TSRMLS_DC);
 static zend_object_value php_sxe_register_object(php_sxe_object * TSRMLS_DC);
 static xmlNodePtr php_sxe_reset_iterator(php_sxe_object *sxe, int use_data TSRMLS_DC);
 static xmlNodePtr php_sxe_iterator_fetch(php_sxe_object *sxe, xmlNodePtr node, int use_data TSRMLS_DC);
+static zval *sxe_get_value(zval *z TSRMLS_DC);
 
 /* {{{ _node_as_zval()
  */
@@ -427,6 +428,7 @@ static void sxe_prop_dim_write(zval *object, zval *member, zval *value, zend_boo
        int             is_attr = 0;
        int                             nodendx = 0;
        int             test = 0;
+       int                             new_value = 0;
        long            cnt;
        zval            tmp_zv, trim_zv, value_copy;
 
@@ -504,8 +506,17 @@ static void sxe_prop_dim_write(zval *object, zval *member, zval *value, zend_boo
                                break;
                        case IS_STRING:
                                break;
+                       case IS_OBJECT:
+                               if (Z_OBJCE_P(value) == sxe_class_entry) {
+                                       value = sxe_get_value(value TSRMLS_CC);
+                                       INIT_PZVAL(value);
+                                       new_value = 1;
+                                       break;
+                               }
+                               /* break is missing intentionally */
                        default:
                                php_error_docref(NULL TSRMLS_CC, E_WARNING, "It is not yet possible to assign complex types to %s", attribs ? "attributes" : "properties");
+                               return;
                }
        }
 
@@ -594,6 +605,9 @@ next_iter:
        if (value && value == &value_copy) {
                zval_dtor(value);
        }
+       if (new_value) {
+               zval_ptr_dtor(&value);
+       }
 }
 /* }}} */