From a9080d38f49a16ed8bfe3d248b4c23243d93f7f7 Mon Sep 17 00:00:00 2001 From: Antony Dovgal Date: Sun, 5 Mar 2006 15:36:03 +0000 Subject: [PATCH] fix #36611 (assignment to SimpleXML object attribute changes argument type to string) --- NEWS | 2 ++ ext/simplexml/simplexml.c | 10 +++++++++- 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/NEWS b/NEWS index c9e0466434e..2d123abd65a 100644 --- a/NEWS +++ b/NEWS @@ -36,6 +36,8 @@ PHP NEWS - Fixed tiger hash algorithm generating wrong results on big endian platforms. (Mike) - Fixed crash with DOMImplementation::createDocumentType("name:"). (Mike) +- Fixed bug #36611 (assignment to SimpleXML object attribute changes argument + type to string). (Tony) - Fixed bug #36606 (pg_query_params() changes arguments type to string). (Tony) - Fixed bug #36599 (DATE_W3C format constant incorrect). (Derick) - Fixed bug #36575 (SOAP: Incorrect complex type instantiation with diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c index 8a321ce0baa..9ba15041886 100644 --- a/ext/simplexml/simplexml.c +++ b/ext/simplexml/simplexml.c @@ -408,7 +408,7 @@ static void sxe_prop_dim_write(zval *object, zval *member, zval *value, zend_boo int nodendx = 0; int test = 0; long cnt; - zval tmp_zv, trim_zv; + zval tmp_zv, trim_zv, value_copy; if (!member) { /* This happens when the user did: $sxe[] = $value @@ -475,6 +475,11 @@ static void sxe_prop_dim_write(zval *object, zval *member, zval *value, zend_boo case IS_BOOL: case IS_DOUBLE: case IS_NULL: + if (value->refcount > 1) { + value_copy = *value; + zval_copy_ctor(&value_copy); + value = &value_copy; + } convert_to_string(value); break; case IS_STRING: @@ -566,6 +571,9 @@ next_iter: if (pnewnode) { *pnewnode = newnode; } + if (value && value == &value_copy) { + zval_dtor(value); + } } /* }}} */