Skip to content

Commit 0d9b039

Browse files
committed
Merge branch 'PHP-8.3'
* PHP-8.3: Fix phpGH-15837: Segmentation fault in ext/simplexml/simplexml.c
2 parents ded8fb7 + bc20b40 commit 0d9b039

File tree

3 files changed

+39
-0
lines changed

3 files changed

+39
-0
lines changed

NEWS

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,10 @@ PHP NEWS
1212
- PCRE:
1313
. Fix UAF issues with PCRE after request shutdown. (nielsdos)
1414

15+
- SimpleXML:
16+
. Fixed bug GH-15837 (Segmentation fault in ext/simplexml/simplexml.c).
17+
(nielsdos)
18+
1519
- SOAP:
1620
. Fixed bug #73182 (PHP SOAPClient does not support stream context HTTP
1721
headers in array form). (nielsdos)

ext/simplexml/simplexml.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2487,6 +2487,11 @@ static void php_sxe_iterator_current_key(zend_object_iterator *iter, zval *key)
24872487
{
24882488
php_sxe_iterator *iterator = (php_sxe_iterator *)iter;
24892489
zval *curobj = &iterator->sxe->iter.data;
2490+
if (Z_ISUNDEF_P(curobj)) {
2491+
ZVAL_NULL(key);
2492+
return;
2493+
}
2494+
24902495
php_sxe_object *intern = Z_SXEOBJ_P(curobj);
24912496

24922497
xmlNodePtr curnode = NULL;

ext/simplexml/tests/gh15837.phpt

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
--TEST--
2+
GH-15837 (Segmentation fault in ext/simplexml/simplexml.c)
3+
--CREDITS--
4+
YuanchengJiang
5+
--FILE--
6+
<?php
7+
$xml =<<<EOF
8+
<xml>
9+
<fieldset1>
10+
</fieldset1>
11+
<fieldset2>
12+
<options>
13+
</options>
14+
</fieldset2>
15+
</xml>
16+
EOF;
17+
$sxe = new SimpleXMLIterator($xml);
18+
$rit = new RecursiveIteratorIterator($sxe, RecursiveIteratorIterator::LEAVES_ONLY);
19+
foreach ($rit as $child) {
20+
$ancestry = $child->xpath('ancestor-or-self::*');
21+
// Exhaust internal iterator
22+
foreach ($ancestry as $ancestor) {
23+
}
24+
}
25+
var_dump($rit->valid());
26+
var_dump($rit->key());
27+
?>
28+
--EXPECT--
29+
bool(false)
30+
NULL

0 commit comments

Comments
 (0)