diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c index d106276fedc..21a6c91ebc1 100644 --- a/ext/simplexml/simplexml.c +++ b/ext/simplexml/simplexml.c @@ -366,6 +366,8 @@ static zval * sxe_dimension_read(zval *object, zval *offset, int type TSRMLS_DC) static void change_node_zval(xmlNodePtr node, zval *value TSRMLS_DC) { zval value_copy; + xmlChar *buffer; + int buffer_len; if (!value) { @@ -385,7 +387,20 @@ static void change_node_zval(xmlNodePtr node, zval *value TSRMLS_DC) convert_to_string(value); /* break missing intentionally */ case IS_STRING: - xmlNodeSetContentLen(node, (xmlChar *)Z_STRVAL_P(value), Z_STRLEN_P(value)); + if (node->type == XML_ATTRIBUTE_NODE) { + buffer = xmlEncodeEntitiesReentrant(node->doc, (xmlChar *)Z_STRVAL_P(value)); + buffer_len = xmlStrlen(buffer); + } else { + buffer = (xmlChar *)Z_STRVAL_P(value); + buffer_len = Z_STRLEN_P(value); + } + /* check for NULL buffer in case of memory error in xmlEncodeEntitiesReentrant */ + if (buffer) { + xmlNodeSetContentLen(node, buffer, buffer_len); + if (node->type == XML_ATTRIBUTE_NODE) { + xmlFree(buffer); + } + } if (value == &value_copy) { zval_dtor(value); } diff --git a/ext/simplexml/tests/bug38424.phpt b/ext/simplexml/tests/bug38424.phpt new file mode 100644 index 00000000000..baab45fe545 --- /dev/null +++ b/ext/simplexml/tests/bug38424.phpt @@ -0,0 +1,26 @@ +--TEST-- +Bug #38424 (Different attribute assignment if new or exists) +--SKIPIF-- + +--FILE-- +'); + +$str = "abc & def" ; + +$xml["a1"] = "" ; +$xml["a1"] = htmlspecialchars($str,ENT_NOQUOTES) ; + +$xml["a2"] = htmlspecialchars($str,ENT_NOQUOTES) ; + +$xml["a3"] = "" ; +$xml["a3"] = $str ; + +$xml["a4"] = $str ; + +echo $xml->asXML(); +?> +--EXPECT-- + +