From c8c0e979826b677de5f786920289056242ea5c54 Mon Sep 17 00:00:00 2001 From: Zeev Suraski Date: Wed, 11 Feb 2004 19:15:30 +0000 Subject: [PATCH] Prevent SimpleXML from silently modifying types of variables that are assigned to its objects. Implementation notes for overloaded object modules: - If you return a zval which is not otherwise referenced by the extension or the engine's symbol table, its reference count should be 0. - If you receive a value zval in write_property/write_dimension, you may only modify it if its reference count is 1. Otherwise, you must create a copy of that zval before making any changes. You should NOT modify the reference count of the value passed to you. Have fun! --- ext/simplexml/simplexml.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c index acf547b960..3615a82ff5 100644 --- a/ext/simplexml/simplexml.c +++ b/ext/simplexml/simplexml.c @@ -274,14 +274,25 @@ static zval * sxe_dimension_read(zval *object, zval *offset, int type TSRMLS_DC) static void change_node_zval(xmlNodePtr node, zval *value) { + zval value_copy; + switch (Z_TYPE_P(value)) { case IS_LONG: case IS_BOOL: case IS_DOUBLE: case IS_NULL: + if (value->refcount > 1) { + value_copy = *value; + zval_copy_ctor(&value_copy); + value = &value_copy; + } convert_to_string(value); + /* break missing intentionally */ case IS_STRING: xmlNodeSetContentLen(node, Z_STRVAL_P(value), Z_STRLEN_P(value)); + if (value == &value_copy) { + zval_dtor(value); + } break; default: php_error(E_WARNING, "It is not possible to assign complex types to nodes"); -- 2.40.0