From: Antony Dovgal <tony2001@php.net>
Date: Tue, 20 Feb 2007 13:21:54 +0000 (+0000)
Subject: fix #38406 (crash when assigning objects to SimpleXML attributes)
X-Git-Tag: RELEASE_1_0_1~208
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=296f20f65777709defa70056156ae4db6f3cff5a;p=php

fix #38406 (crash when assigning objects to SimpleXML attributes)
---

diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c
index 9d4385a3ae..079728e357 100644
--- a/ext/simplexml/simplexml.c
+++ b/ext/simplexml/simplexml.c
@@ -56,6 +56,7 @@ static php_sxe_object* php_sxe_object_new(zend_class_entry *ce TSRMLS_DC);
 static zend_object_value php_sxe_register_object(php_sxe_object * TSRMLS_DC);
 static xmlNodePtr php_sxe_reset_iterator(php_sxe_object *sxe, int use_data TSRMLS_DC);
 static xmlNodePtr php_sxe_iterator_fetch(php_sxe_object *sxe, xmlNodePtr node, int use_data TSRMLS_DC);
+static zval *sxe_get_value(zval *z TSRMLS_DC);
 
 /* {{{ _node_as_zval()
  */
@@ -428,6 +429,7 @@ static void sxe_prop_dim_write(zval *object, zval *member, zval *value, zend_boo
 	int             is_attr = 0;
 	int				nodendx = 0;
 	int             test = 0;
+	int				new_value = 0;
 	long            cnt;
 	zval            tmp_zv, trim_zv, value_copy;
 
@@ -506,8 +508,17 @@ static void sxe_prop_dim_write(zval *object, zval *member, zval *value, zend_boo
 				break;
 			case IS_STRING:
 				break;
+			case IS_OBJECT:
+				if (Z_OBJCE_P(value) == sxe_class_entry) {
+					value = sxe_get_value(value TSRMLS_CC);
+					INIT_PZVAL(value);
+					new_value = 1;
+					break;
+				}
+				/* break is missing intentionally */
 			default:
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "It is not yet possible to assign complex types to %s", attribs ? "attributes" : "properties");
+				return;
 		}
 	}
 
@@ -596,6 +607,9 @@ next_iter:
 	if (value && value == &value_copy) {
 		zval_dtor(value);
 	}
+	if (new_value) {
+		zval_ptr_dtor(&value);
+	}
 }
 /* }}} */