From a0beddf5e9ab3c6feaf0921be72a7f430597abea Mon Sep 17 00:00:00 2001
From: Anatol Belski <ab@php.net>
Date: Sat, 5 Apr 2014 09:46:24 +0200
Subject: [PATCH] Fixed bug #66084 simplexml_load_string() mangles empty node
 name

---
 NEWS                                |  4 ++
 ext/simplexml/simplexml.c           |  2 +-
 ext/simplexml/tests/bug66084_0.phpt | 68 +++++++++++++++++++++++++++++
 ext/simplexml/tests/bug66084_1.phpt | 17 ++++++++
 4 files changed, 90 insertions(+), 1 deletion(-)
 create mode 100644 ext/simplexml/tests/bug66084_0.phpt
 create mode 100644 ext/simplexml/tests/bug66084_1.phpt

diff --git a/NEWS b/NEWS
index bf8d1d2a4d..fde89e9ca7 100644
--- a/NEWS
+++ b/NEWS
@@ -16,6 +16,10 @@ PHP                                                                        NEWS
   . Fixed bug #66987i (Memory corruption in fileinfo ext / bigendian).
     (Remi)
 
+- SimpleXML:
+  . Fixed bug #66084 (simplexml_load_string() mangles empty node name)
+    (Anatol)
+
 - XSL:
   . Fixed bug #53965 (<xsl:include> cannot find files with relative paths
     when loaded with "file://"). (Anatol)
diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c
index b9966ddcce..15a8512a43 100644
--- a/ext/simplexml/simplexml.c
+++ b/ext/simplexml/simplexml.c
@@ -1129,7 +1129,7 @@ static HashTable * sxe_get_prop_hash(zval *object, int is_debug TSRMLS_DC) /* {{
 			node = NULL;
 		} else if (sxe->iter.type != SXE_ITER_CHILD) {
 
-			if ( !node->children || !node->parent || node->children->next || node->children->children || node->parent->children == node->parent->last ) {
+			if ( !node->children || !node->parent || !node->next || node->children->next || node->children->children || node->parent->children == node->parent->last ) {
 				node = node->children;
 			} else {
 				iter_data = sxe->iter.data;
diff --git a/ext/simplexml/tests/bug66084_0.phpt b/ext/simplexml/tests/bug66084_0.phpt
new file mode 100644
index 0000000000..35f4daf876
--- /dev/null
+++ b/ext/simplexml/tests/bug66084_0.phpt
@@ -0,0 +1,68 @@
+--TEST--
+Bug #66084 simplexml_load_string() mangles empty node name, var_dump variant
+--SKIPIF--
+<?php if (!extension_loaded("simplexml")) print "skip simplexml not available"; ?>
+--FILE--
+<?php
+echo var_dump(simplexml_load_string('<a><b/><c><x/></c></a>')), "\n";
+echo var_dump(simplexml_load_string('<a><b/><d/><c><x/></c></a>')), "\n";
+echo var_dump(simplexml_load_string('<a><b/><c><d/><x/></c></a>')), "\n";
+echo var_dump(simplexml_load_string('<a><b/><c><d><x/></d></c></a>')), "\n";
+?>
+--EXPECT--
+object(SimpleXMLElement)#1 (2) {
+  ["b"]=>
+  object(SimpleXMLElement)#2 (0) {
+  }
+  ["c"]=>
+  object(SimpleXMLElement)#3 (1) {
+    ["x"]=>
+    object(SimpleXMLElement)#4 (0) {
+    }
+  }
+}
+
+object(SimpleXMLElement)#1 (3) {
+  ["b"]=>
+  object(SimpleXMLElement)#3 (0) {
+  }
+  ["d"]=>
+  object(SimpleXMLElement)#2 (0) {
+  }
+  ["c"]=>
+  object(SimpleXMLElement)#4 (1) {
+    ["x"]=>
+    object(SimpleXMLElement)#5 (0) {
+    }
+  }
+}
+
+object(SimpleXMLElement)#1 (2) {
+  ["b"]=>
+  object(SimpleXMLElement)#4 (0) {
+  }
+  ["c"]=>
+  object(SimpleXMLElement)#2 (2) {
+    ["d"]=>
+    object(SimpleXMLElement)#3 (0) {
+    }
+    ["x"]=>
+    object(SimpleXMLElement)#5 (0) {
+    }
+  }
+}
+
+object(SimpleXMLElement)#1 (2) {
+  ["b"]=>
+  object(SimpleXMLElement)#2 (0) {
+  }
+  ["c"]=>
+  object(SimpleXMLElement)#4 (1) {
+    ["d"]=>
+    object(SimpleXMLElement)#5 (1) {
+      ["x"]=>
+      object(SimpleXMLElement)#3 (0) {
+      }
+    }
+  }
+}
diff --git a/ext/simplexml/tests/bug66084_1.phpt b/ext/simplexml/tests/bug66084_1.phpt
new file mode 100644
index 0000000000..80e91df7c6
--- /dev/null
+++ b/ext/simplexml/tests/bug66084_1.phpt
@@ -0,0 +1,17 @@
+--TEST--
+Bug #66084 simplexml_load_string() mangles empty node name, json variant
+--SKIPIF--
+<?php if (!extension_loaded("simplexml")) print "skip simplexml not available"; ?>
+<?php if (!extension_loaded("json")) print "skip json not available"; ?>
+--FILE--
+<?php
+echo json_encode(simplexml_load_string('<a><b/><c><x/></c></a>')), "\n";
+echo json_encode(simplexml_load_string('<a><b/><d/><c><x/></c></a>')), "\n";
+echo json_encode(simplexml_load_string('<a><b/><c><d/><x/></c></a>')), "\n";
+echo json_encode(simplexml_load_string('<a><b/><c><d><x/></d></c></a>')), "\n";
+?>
+--EXPECT--
+{"b":{},"c":{"x":{}}}
+{"b":{},"d":{},"c":{"x":{}}}
+{"b":{},"c":{"d":{},"x":{}}}
+{"b":{},"c":{"d":{"x":{}}}}
-- 
2.50.0