diff options
| author | Antony Dovgal <tony2001@php.net> | 2007-06-05 10:02:02 +0000 |
|---|---|---|
| committer | Antony Dovgal <tony2001@php.net> | 2007-06-05 10:02:02 +0000 |
| commit | 878577579c7e2fcf0951f676aa753f904704fb85 (patch) | |
| tree | 52c37f55956868ef59db2a955dbb9d7fe950a728 /ext/simplexml | |
| parent | 484e14354eb92e33b23a92122abcda577642fdb9 (diff) | |
| download | php-git-878577579c7e2fcf0951f676aa753f904704fb85.tar.gz | |
fix #41582 (SimpleXML crashes when accessing newly created element)
Diffstat (limited to 'ext/simplexml')
| -rw-r--r-- | ext/simplexml/simplexml.c | 12 | ||||
| -rw-r--r-- | ext/simplexml/tests/bug41582.phpt | 15 |
2 files changed, 24 insertions, 3 deletions
diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c index 3fb12d59e8..0c420c603a 100644 --- a/ext/simplexml/simplexml.c +++ b/ext/simplexml/simplexml.c @@ -238,7 +238,7 @@ next_iter: /* {{{ sxe_prop_dim_read() */ -static zval * sxe_prop_dim_read(zval *object, zval *member, zend_bool elements, zend_bool attribs, zend_bool silent TSRMLS_DC) +static zval * sxe_prop_dim_read(zval *object, zval *member, zend_bool elements, zend_bool attribs, int type TSRMLS_DC) { zval *return_value; php_sxe_object *sxe; @@ -249,6 +249,12 @@ static zval * sxe_prop_dim_read(zval *object, zval *member, zend_bool elements, int nodendx = 0; int test = 0; + if (!member) { + return_value = &EG(uninitialized_zval); + return_value->is_ref = 1; + return return_value; + } + sxe = php_sxe_fetch_object(object TSRMLS_CC); if (Z_TYPE_P(member) == IS_LONG) { @@ -357,7 +363,7 @@ static zval * sxe_prop_dim_read(zval *object, zval *member, zend_bool elements, */ static zval * sxe_property_read(zval *object, zval *member, int type TSRMLS_DC) { - return sxe_prop_dim_read(object, member, 1, 0, type == BP_VAR_IS TSRMLS_CC); + return sxe_prop_dim_read(object, member, 1, 0, type TSRMLS_CC); } /* }}} */ @@ -365,7 +371,7 @@ static zval * sxe_property_read(zval *object, zval *member, int type TSRMLS_DC) */ static zval * sxe_dimension_read(zval *object, zval *offset, int type TSRMLS_DC) { - return sxe_prop_dim_read(object, offset, 0, 1, 0 TSRMLS_CC); + return sxe_prop_dim_read(object, offset, 0, 1, type TSRMLS_CC); } /* }}} */ diff --git a/ext/simplexml/tests/bug41582.phpt b/ext/simplexml/tests/bug41582.phpt new file mode 100644 index 0000000000..e6e364801a --- /dev/null +++ b/ext/simplexml/tests/bug41582.phpt @@ -0,0 +1,15 @@ +--TEST-- +Bug #41582 (SimpleXML crashes when accessing newly created element) +--FILE-- +<?php + +$xml = new SimpleXMLElement(b'<?xml version="1.0" standalone="yes"?><collection></collection>'); + +$xml->movie[]->characters->character[0]->name = b'Miss Coder'; + +var_dump($xml->asXml()); + +echo "Done\n"; +?> +--EXPECTF-- +Fatal error: Cannot use object of type stdClass as array in %s on line %d |