From: Antony Dovgal <tony2001@php.net>
Date: Sun, 5 Mar 2006 15:58:09 +0000 (+0000)
Subject: MF51: fix #36611 (assignment to SimpleXML object attribute changes argument type... 
X-Git-Tag: RELEASE_1_3~542
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=def2ab1ac1b9785623267c10bb3a2fd3447e840c;p=php

MF51: fix #36611 (assignment to SimpleXML object attribute changes argument type to string)
---

diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c
index 3b23eee7fa..56cd5ddadc 100644
--- a/ext/simplexml/simplexml.c
+++ b/ext/simplexml/simplexml.c
@@ -409,7 +409,7 @@ static void sxe_prop_dim_write(zval *object, zval *member, zval *value, zend_boo
 	int				nodendx = 0;
 	int             test = 0;
 	long            cnt;
-	zval            tmp_zv, trim_zv;
+	zval            tmp_zv, trim_zv, value_copy;
 
 	if (!member) {
 		/* This happens when the user did: $sxe[] = $value
@@ -477,6 +477,11 @@ static void sxe_prop_dim_write(zval *object, zval *member, zval *value, zend_boo
 			case IS_DOUBLE:
 			case IS_NULL:
 			case IS_UNICODE:
+				if (value->refcount > 1) {
+					value_copy = *value;
+					zval_copy_ctor(&value_copy);
+					value = &value_copy;
+				}
 				convert_to_string(value);
 				break;
 			case IS_STRING:
@@ -568,6 +573,9 @@ next_iter:
 	if (pnewnode) {
 		*pnewnode = newnode;
 	}
+	if (value && value == &value_copy) {
+		zval_dtor(value);
+	}
 }
 /* }}} */