From: Antony Dovgal <tony2001@php.net>
Date: Sun, 6 Aug 2006 17:41:39 +0000 (+0000)
Subject: fix #38347 (Segmentation fault when using foreach with an unknown/empty SimpleXMLElement)
X-Git-Tag: RELEASE_1_0_0RC1~2072
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=61312ae102a09031e1ef4e8abe1c861d904a03c4;p=php

fix #38347 (Segmentation fault when using foreach with an unknown/empty SimpleXMLElement)
---

diff --git a/ext/libxml/libxml.c b/ext/libxml/libxml.c
index 6c9d37fc13..6163e559bd 100644
--- a/ext/libxml/libxml.c
+++ b/ext/libxml/libxml.c
@@ -976,8 +976,8 @@ int php_libxml_decrement_doc_ref(php_libxml_node_object *object TSRMLS_DC) {
 				efree(object->document->doc_props);
 			}
 			efree(object->document);
+			object->document = NULL;
 		}
-		object->document = NULL;
 	}
 
 	return ret_refcount;
@@ -1035,6 +1035,8 @@ void php_libxml_node_decrement_resource(php_libxml_node_object *object TSRMLS_DC
 				obj_node->_private = NULL;
 			}
 		}
+	}
+	if (object != NULL && object->document != NULL) {
 		/* Safe to call as if the resource were freed then doc pointer is NULL */
 		php_libxml_decrement_doc_ref(object TSRMLS_CC);
 	}
diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c
index 153825a548..2afaa49553 100644
--- a/ext/simplexml/simplexml.c
+++ b/ext/simplexml/simplexml.c
@@ -195,6 +195,9 @@ static xmlNodePtr sxe_get_element_by_name(php_sxe_object *sxe, xmlNodePtr node,
 
 	if (sxe->iter.type == SXE_ITER_ELEMENT) {
 		orgnode = sxe_find_element_by_name(sxe, node, sxe->iter.name TSRMLS_CC);
+		if (!orgnode) {
+			return NULL;
+		}
 		node = orgnode->children;
 	}
 
diff --git a/ext/simplexml/tests/bug38347.phpt b/ext/simplexml/tests/bug38347.phpt
new file mode 100644
index 0000000000..1dfad4d60d
--- /dev/null
+++ b/ext/simplexml/tests/bug38347.phpt
@@ -0,0 +1,35 @@
+--TEST--
+Bug #38347 (Segmentation fault when using foreach with an unknown/empty SimpleXMLElement)
+--SKIPIF--
+<?php if (!extension_loaded("simplexml")) print "skip"; ?>
+--FILE--
+<?php
+
+function iterate($xml)
+{
+    print_r($xml);
+    foreach ($xml->item as $item) {
+        echo "This code will crash!";
+    }
+}
+
+$xmlstr = "<xml><item>Item 1</item><item>Item 2</item></xml>";
+$xml = simplexml_load_string($xmlstr);
+iterate($xml->unknown);
+
+echo "Done\n";
+?>
+--EXPECTF--	
+SimpleXMLElement Object
+(
+)
+
+Warning: iterate(): Node no longer exists in %s on line %d
+Done
+--UEXPECTF--
+SimpleXMLElement Object
+(
+)
+
+Warning: iterate(): Node no longer exists in %s on line %d
+Done