From: Xinchen Hui <laruence@gmail.com>
Date: Wed, 13 Jul 2016 02:49:58 +0000 (+0800)
Subject: Fixed bug #72588 (Using global var doesn't work while accessing SimpleXML element)
X-Git-Tag: php-7.1.0beta1~72^2~1^2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=8129b839922c14e1a4b3a82c702faa178e1cdec3;p=php

Fixed bug #72588 (Using global var doesn't work while accessing SimpleXML element)
---

diff --git a/NEWS b/NEWS
index 326c6c4510..738568b96b 100644
--- a/NEWS
+++ b/NEWS
@@ -35,6 +35,10 @@ PHP                                                                        NEWS
   . Fixed bug #72570 (Segmentation fault when binding parameters on a query
     without placeholders). (Matteo)
 
+- SimpleXML:
+  . Fixed bug #72588 (Using global var doesn't work while accessing SimpleXML
+    element). (Laruence)
+
 - SPL:
   . Fixed bug #55701 (GlobIterator throws LogicException). (Valentin VĂLCIU)
 
diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c
index 8a1ef4915f..3b27656786 100644
--- a/ext/simplexml/simplexml.c
+++ b/ext/simplexml/simplexml.c
@@ -244,22 +244,29 @@ static zval *sxe_prop_dim_read(zval *object, zval *member, zend_bool elements, z
 
 	sxe = Z_SXEOBJ_P(object);
 
-	if (!member || Z_TYPE_P(member) == IS_LONG) {
-		if (sxe->iter.type != SXE_ITER_ATTRLIST) {
-			attribs = 0;
-			elements = 1;
-		} else if (!member) {
+	if (!member) {
+		if (sxe->iter.type == SXE_ITER_ATTRLIST) {
 			/* This happens when the user did: $sxe[]->foo = $value */
 			php_error_docref(NULL, E_ERROR, "Cannot create unnamed attribute");
 			return NULL;
 		}
-		name = NULL;
+		goto long_dim;
 	} else {
-		if (Z_TYPE_P(member) != IS_STRING) {
-			ZVAL_STR(&tmp_zv, zval_get_string(member));
-			member = &tmp_zv;
+		ZVAL_DEREF(member);
+		if (Z_TYPE_P(member) == IS_LONG) {
+			if (sxe->iter.type != SXE_ITER_ATTRLIST) {
+long_dim:
+				attribs = 0;
+				elements = 1;
+			}
+			name = NULL;
+		} else {
+			if (Z_TYPE_P(member) != IS_STRING) {
+				ZVAL_STR(&tmp_zv, zval_get_string(member));
+				member = &tmp_zv;
+			}
+			name = Z_STRVAL_P(member);
 		}
-		name = Z_STRVAL_P(member);
 	}
 
 	GET_NODE(sxe, node);
@@ -450,11 +457,8 @@ static int sxe_prop_dim_write(zval *object, zval *member, zval *value, zend_bool
 
 	sxe = Z_SXEOBJ_P(object);
 
-	if (!member || Z_TYPE_P(member) == IS_LONG) {
-		if (sxe->iter.type != SXE_ITER_ATTRLIST) {
-			attribs = 0;
-			elements = 1;
-		} else if (!member) {
+	if (!member) {
+		if (sxe->iter.type == SXE_ITER_ATTRLIST) {
 			/* This happens when the user did: $sxe[] = $value
 			 * and could also be E_PARSE, but we use this only during parsing
 			 * and this is during runtime.
@@ -462,20 +466,30 @@ static int sxe_prop_dim_write(zval *object, zval *member, zval *value, zend_bool
 			php_error_docref(NULL, E_ERROR, "Cannot create unnamed attribute");
 			return FAILURE;
 		}
+		goto long_dim;
 	} else {
-		if (Z_TYPE_P(member) != IS_STRING) {
-			trim_str = zval_get_string(member);
-			ZVAL_STR(&tmp_zv, php_trim(trim_str, NULL, 0, 3));
-			zend_string_release(trim_str);
-			member = &tmp_zv;
-		}
+		ZVAL_DEREF(member);
+		if (Z_TYPE_P(member) == IS_LONG) {
+			if (sxe->iter.type != SXE_ITER_ATTRLIST) {
+long_dim:
+				attribs = 0;
+				elements = 1;
+			}
+		} else {
+			if (Z_TYPE_P(member) != IS_STRING) {
+				trim_str = zval_get_string(member);
+				ZVAL_STR(&tmp_zv, php_trim(trim_str, NULL, 0, 3));
+				zend_string_release(trim_str);
+				member = &tmp_zv;
+			}
 
-		if (!Z_STRLEN_P(member)) {
-			php_error_docref(NULL, E_WARNING, "Cannot write or create unnamed %s", attribs ? "attribute" : "element");
-			if (member == &tmp_zv) {
-				zval_dtor(&tmp_zv);
+			if (!Z_STRLEN_P(member)) {
+				php_error_docref(NULL, E_WARNING, "Cannot write or create unnamed %s", attribs ? "attribute" : "element");
+				if (member == &tmp_zv) {
+					zval_dtor(&tmp_zv);
+				}
+				return FAILURE;
 			}
-			return FAILURE;
 		}
 	}
 
diff --git a/ext/simplexml/tests/bug72588.phpt b/ext/simplexml/tests/bug72588.phpt
new file mode 100644
index 0000000000..f32ec25104
--- /dev/null
+++ b/ext/simplexml/tests/bug72588.phpt
@@ -0,0 +1,41 @@
+--TEST--
+Bug #72588 (Using global var doesn't work while accessing SimpleXML element)
+--SKIPIF--
+<?php
+if (!extension_loaded("simplexml")) die("skip SimpleXML not available");
+?>
+--FILE--
+<?php
+
+$tpnb = 5;
+$dummy = &$tpnb;
+
+$xmlStruct = <<<EOF
+<?xml version="1.0" encoding="UTF-8"?>
+<templates>
+	<object type="obj_1" label="Label for object 1"></object>
+	<object type="obj_2" label="Label for object 2"></object>
+	<object type="obj_3" label="Label for object 3"></object>
+	<object type="obj_4" label="Label for object 4"></object>
+	<object type="obj_5" label="Label for object 5"></object>
+	<object type="obj_6" label="Label for object 6"></object>
+	<object type="obj_7" label="Label for object 7"></object>
+	<object type="obj_8" label="Label for object 8"></object>
+	<object type="obj_9" label="Label for object 9"></object>
+	<object type="obj_10" label="Label for object 10"></object>
+</templates>
+EOF;
+$tplxml = simplexml_load_string($xmlStruct);
+
+var_dump($tplxml->object[$tpnb]);
+?>
+--EXPECTF--
+object(SimpleXMLElement)#%d (1) {
+  ["@attributes"]=>
+  array(2) {
+    ["type"]=>
+    string(5) "obj_6"
+    ["label"]=>
+    string(18) "Label for object 6"
+  }
+}