diff --git a/NEWS b/NEWS index 05e3a23118d2..7b189d4900d7 100644 --- a/NEWS +++ b/NEWS @@ -58,6 +58,8 @@ PHP NEWS - SimpleXML: . Fixed integer element offsets that cannot resolve aliasing an existing element. (iliaal) + . Fixed segfault when comparing uninitialized SimpleXMLElement + instances. (iliaal) - Sockets: . Fixed various memory related issues in ext/sockets. (David Carlier) diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c index f3c1a073fcaf..1a346200199b 100644 --- a/ext/simplexml/simplexml.c +++ b/ext/simplexml/simplexml.c @@ -1237,7 +1237,7 @@ static int sxe_objects_compare(zval *object1, zval *object2) /* {{{ */ if (sxe1->node == NULL && sxe2->node == NULL) { /* Both nodes not set: Only support equality comparison between documents. */ - if (sxe1->document->ptr == sxe2->document->ptr) { + if (sxe1->document != NULL && sxe2->document != NULL && sxe1->document->ptr == sxe2->document->ptr) { return 0; } return ZEND_UNCOMPARABLE; diff --git a/ext/simplexml/tests/bug_sxe_compare_uninitialized.phpt b/ext/simplexml/tests/bug_sxe_compare_uninitialized.phpt new file mode 100644 index 000000000000..4d915b66c3a3 --- /dev/null +++ b/ext/simplexml/tests/bug_sxe_compare_uninitialized.phpt @@ -0,0 +1,28 @@ +--TEST-- +Comparing uninitialized SimpleXMLElement instances must not segfault +--EXTENSIONS-- +simplexml +--FILE-- +'); +echo "uninit vs init: "; +var_dump($a == $c); +echo "done\n"; +?> +--EXPECT-- +self: bool(true) +equal: bool(false) +identical: bool(false) +uninit vs init: bool(false) +done