diff --git a/NEWS b/NEWS index 474db936ef15..a9ca3fea246c 100644 --- a/NEWS +++ b/NEWS @@ -42,6 +42,10 @@ PHP NEWS . Fixed bug GH-23043 (broken session id code can cause zend_mm_heap corrupted). (ndossche) +- SimpleXML: + . Fixed segfault when comparing uninitialized SimpleXMLElement + instances. (iliaal) + - Sockets: . Fixed various memory related issues in ext/sockets. (David Carlier) diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c index 8cf8e657e58f..b3266f813975 100644 --- a/ext/simplexml/simplexml.c +++ b/ext/simplexml/simplexml.c @@ -1229,6 +1229,12 @@ static int sxe_objects_compare(zval *object1, zval *object2) /* {{{ */ if (sxe1->node == NULL && sxe2->node == NULL) { /* Both nodes not set: Only support equality comparison between documents. */ + if (sxe1->document == NULL || sxe2->document == NULL) { + if (sxe1->document == sxe2->document) { + return 0; + } + return ZEND_UNCOMPARABLE; + } if (sxe1->document->ptr == sxe2->document->ptr) { return 0; } diff --git a/ext/simplexml/tests/bug_sxe_compare_uninitialized.phpt b/ext/simplexml/tests/bug_sxe_compare_uninitialized.phpt new file mode 100644 index 000000000000..742761eed6c0 --- /dev/null +++ b/ext/simplexml/tests/bug_sxe_compare_uninitialized.phpt @@ -0,0 +1,25 @@ +--TEST-- +Comparing uninitialized SimpleXMLElement instances must not segfault +--EXTENSIONS-- +simplexml +--FILE-- +'); +echo "uninit vs init: "; +var_dump($a == $c); +echo "done\n"; +?> +--EXPECT-- +equal: bool(true) +identical: bool(false) +uninit vs init: bool(false) +done