Fix Bug #27769 crash using domxml_xmltree

diff --git a/ext/domxml/php_domxml.c b/ext/domxml/php_domxml.c
index 09b404456a7b0c0c8eae6c0a1b2ff6fbc2713643..b52aa43b488db6efb6a2d7206033271c6c108f6c 100644 (file)
--- a/ext/domxml/php_domxml.c
+++ b/ext/domxml/php_domxml.c
@@ -4803,15 +4803,17 @@ PHP_FUNCTION(domxml_xmltree)
                RETURN_FALSE;
        }
 
-       DOMXML_RET_OBJ(rv, (xmlNodePtr) docp, &ret);
+       DOMXML_DOMOBJ_NEW(rv, (xmlNodePtr) docp, &ret);
 
        /* The root itself maybe an array. Though you may not have two Elements
           as root, you may have a comment, pi and and element as root.
           Thanks to Paul DuBois for pointing me at this.
         */
        if (node_children(&children, root TSRMLS_CC) >= 0) {
-               zend_hash_update(Z_OBJPROP_P(return_value), "children",sizeof("children"), (void *) &children, sizeof(zval *), NULL);
+               zend_hash_update(Z_OBJPROP_P(rv), "children",sizeof("children"), (void *) &children, sizeof(zval *), NULL);
        }
+
+       DOMXML_RET_ZVAL(rv);
 /*     xmlFreeDoc(docp); */
 }
 /* }}} */