summaryrefslogtreecommitdiff
path: root/ext/simplexml
diff options
context:
space:
mode:
Diffstat (limited to 'ext/simplexml')
-rw-r--r--ext/simplexml/simplexml.c12
-rw-r--r--ext/simplexml/tests/bug41582.phpt16
2 files changed, 25 insertions, 3 deletions
diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c
index dc5b6c8983..4c0fdf11a2 100644
--- a/ext/simplexml/simplexml.c
+++ b/ext/simplexml/simplexml.c
@@ -238,7 +238,7 @@ next_iter:
/* {{{ sxe_prop_dim_read()
*/
-static zval * sxe_prop_dim_read(zval *object, zval *member, zend_bool elements, zend_bool attribs, zend_bool silent TSRMLS_DC)
+static zval * sxe_prop_dim_read(zval *object, zval *member, zend_bool elements, zend_bool attribs, int type TSRMLS_DC)
{
zval *return_value;
php_sxe_object *sxe;
@@ -249,6 +249,12 @@ static zval * sxe_prop_dim_read(zval *object, zval *member, zend_bool elements,
int nodendx = 0;
int test = 0;
+ if (!member) {
+ return_value = &EG(uninitialized_zval);
+ return_value->is_ref = 1;
+ return return_value;
+ }
+
sxe = php_sxe_fetch_object(object TSRMLS_CC);
if (Z_TYPE_P(member) == IS_LONG) {
@@ -357,7 +363,7 @@ static zval * sxe_prop_dim_read(zval *object, zval *member, zend_bool elements,
*/
static zval * sxe_property_read(zval *object, zval *member, int type TSRMLS_DC)
{
- return sxe_prop_dim_read(object, member, 1, 0, type == BP_VAR_IS TSRMLS_CC);
+ return sxe_prop_dim_read(object, member, 1, 0, type TSRMLS_CC);
}
/* }}} */
@@ -365,7 +371,7 @@ static zval * sxe_property_read(zval *object, zval *member, int type TSRMLS_DC)
*/
static zval * sxe_dimension_read(zval *object, zval *offset, int type TSRMLS_DC)
{
- return sxe_prop_dim_read(object, offset, 0, 1, 0 TSRMLS_CC);
+ return sxe_prop_dim_read(object, offset, 0, 1, type TSRMLS_CC);
}
/* }}} */
diff --git a/ext/simplexml/tests/bug41582.phpt b/ext/simplexml/tests/bug41582.phpt
new file mode 100644
index 0000000000..5f0aa78006
--- /dev/null
+++ b/ext/simplexml/tests/bug41582.phpt
@@ -0,0 +1,16 @@
+--TEST--
+Bug #41582 (SimpleXML crashes when accessing newly created element)
+--FILE--
+<?php
+
+$xml = new SimpleXMLElement('<?xml version="1.0" standalone="yes"?>
+<collection></collection>');
+
+$xml->movie[]->characters->character[0]->name = 'Miss Coder';
+
+var_dump($xml->asXml());
+
+echo "Done\n";
+?>
+--EXPECTF--
+Fatal error: Cannot use object of type stdClass as array in %s on line %d