From baff4e0ab5c831a5780d0a12b3080994965dd2dc Mon Sep 17 00:00:00 2001
From: Ilia Alshanetsky <iliaa@php.net>
Date: Sun, 13 Aug 2006 15:02:41 +0000
Subject: [PATCH] Fixed bug #38438 (DOMNodeList->item(0) segfault on empty
 NodeList)

---
 NEWS                        |  3 ++-
 ext/dom/nodelist.c          |  2 +-
 ext/dom/tests/bug38438.phpt | 13 +++++++++++++
 3 files changed, 16 insertions(+), 2 deletions(-)
 create mode 100644 ext/dom/tests/bug38438.phpt

diff --git a/NEWS b/NEWS
index 37ff4420e0..cb8115c1ed 100644
--- a/NEWS
+++ b/NEWS
@@ -37,6 +37,7 @@ PHP                                                                        NEWS
 - Fixed phpinfo() cutoff of variables at \0. (Ilia)
 - Fixed a bug in the filter extension that prevented magic_quotes_gpc from
   being applied when RAW filter is used. (Ilia)
+- FixedbBug #38438 (DOMNodeList->item(0) segfault on empty NodeList). (Ilia)
 - Fixed bug #38431 (xmlrpc_get_type() crashes PHP on objects). (Tony)
 - Fixed bug #38394 (PDO fails to recover from failed prepared statement
   execution). (Ilia)
@@ -45,7 +46,7 @@ PHP                                                                        NEWS
 - Fixed bug #38354 (Unwanted reformatting of XML when using AsXML). (Christian)
 - Fixed bug #38347 (Segmentation fault when using foreach with an unknown/empty 
   SimpleXMLElement). (Tony)
-- Fixed bug #38322 (reading past array in sscanf() leads to arbitary code 
+- Fixed bug #38322 (reading past array in sscanf() leads to arbitrary code 
   execution). (Tony)
 - Fixed bug #38303 (spl_autoload_register() supress all errors silently).
   (Ilia)
diff --git a/ext/dom/nodelist.c b/ext/dom/nodelist.c
index 8989f907ad..268879bc16 100644
--- a/ext/dom/nodelist.c
+++ b/ext/dom/nodelist.c
@@ -134,7 +134,7 @@ PHP_FUNCTION(dom_nodelist_item)
 						zval_copy_ctor(return_value);
 						return;
 					}
-				} else {
+				} else if (objmap->baseobj) {
 					nodep = dom_object_get_node(objmap->baseobj);
 					if (nodep) {
 						if (objmap->nodetype == XML_ATTRIBUTE_NODE || objmap->nodetype == XML_ELEMENT_NODE) {
diff --git a/ext/dom/tests/bug38438.phpt b/ext/dom/tests/bug38438.phpt
new file mode 100644
index 0000000000..f51252832c
--- /dev/null
+++ b/ext/dom/tests/bug38438.phpt
@@ -0,0 +1,13 @@
+--TEST--
+Bug #38438 (DOMNodeList->item(0) segfault on empty NodeList)
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+$list = new DOMNodeList();
+var_dump($list->item(0));
+echo "OK\n";
+?>
+--EXPECT--
+NULL
+OK
-- 
2.50.1