From: Antony Dovgal <tony2001@php.net>
Date: Tue, 20 Feb 2007 14:08:43 +0000 (+0000)
Subject: MFH: fix leak and errmsg
X-Git-Tag: php-5.2.2RC1~350
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=180baf01093fc0ed73d9904b85ec93485605c752;p=php

MFH: fix leak and errmsg
add test
---

diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c
index a37b858a53..8787e542a1 100644
--- a/ext/simplexml/simplexml.c
+++ b/ext/simplexml/simplexml.c
@@ -515,7 +515,10 @@ static void sxe_prop_dim_write(zval *object, zval *member, zval *value, zend_boo
 				}
 				/* break is missing intentionally */
 			default:
-				php_error_docref(NULL TSRMLS_CC, E_WARNING, "It is not yet possible to assign complex types to %s", attribs ? "attributes" : "properties");
+				if (member == &tmp_zv) {
+					zval_dtor(&tmp_zv);
+				}
+				zend_error(E_WARNING, "It is not yet possible to assign complex types to %s", attribs ? "attributes" : "properties");
 				return;
 		}
 	}
diff --git a/ext/simplexml/tests/bug38406.phpt b/ext/simplexml/tests/bug38406.phpt
new file mode 100644
index 0000000000..f439e33e5e
--- /dev/null
+++ b/ext/simplexml/tests/bug38406.phpt
@@ -0,0 +1,33 @@
+--TEST--
+Bug #38406 (crash when assigning objects to SimpleXML attributes)
+--SKIPIF--
+<?php if (!extension_loaded("simplexml")) print "skip"; ?>
+--FILE--
+<?php
+
+$item = new SimpleXMLElement(b'<something />');
+$item->attribute = b'something';
+var_dump($item->attribute);
+
+$item->otherAttribute = $item->attribute;
+var_dump($item->otherAttribute);
+
+$a = array();
+$item->$a = new stdclass;
+
+echo "Done\n";
+?>
+--EXPECTF--	
+object(SimpleXMLElement)#%d (1) {
+  [0]=>
+  string(9) "something"
+}
+object(SimpleXMLElement)#%d (1) {
+  [0]=>
+  string(9) "something"
+}
+
+Notice: Array to string conversion in %s on line %d
+
+Warning: It is not yet possible to assign complex types to properties in %s on line %d
+Done