diff --git a/NEWS b/NEWS index c8575993afb..33b3f0577ce 100644 --- a/NEWS +++ b/NEWS @@ -19,6 +19,8 @@ PHP NEWS within foreach). (nielsdos) . Fixed bug GH-12223 (Entity reference produces infinite loop in var_dump/print_r). (nielsdos) + . Fixed bug GH-12208 (SimpleXML infinite loop when a cast is used inside a + foreach). (nielsdos) 14 Sep 2023, PHP 8.3.0RC2 diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c index 0b406dec44e..06d04e9a69b 100644 --- a/ext/simplexml/simplexml.c +++ b/ext/simplexml/simplexml.c @@ -1853,7 +1853,7 @@ static zend_result sxe_object_cast_ex(zend_object *readobj, zval *writeobj, int sxe = php_sxe_fetch_object(readobj); if (type == _IS_BOOL) { - node = php_sxe_get_first_node(sxe, NULL); + node = php_sxe_get_first_node_non_destructive(sxe, NULL); if (node) { ZVAL_TRUE(writeobj); } else { @@ -1863,7 +1863,7 @@ static zend_result sxe_object_cast_ex(zend_object *readobj, zval *writeobj, int } if (sxe->iter.type != SXE_ITER_NONE) { - node = php_sxe_get_first_node(sxe, NULL); + node = php_sxe_get_first_node_non_destructive(sxe, NULL); if (node) { contents = xmlNodeListGetString((xmlDocPtr) sxe->document->ptr, node->children, 1); } diff --git a/ext/simplexml/tests/gh12208.phpt b/ext/simplexml/tests/gh12208.phpt new file mode 100644 index 00000000000..da3a997a504 --- /dev/null +++ b/ext/simplexml/tests/gh12208.phpt @@ -0,0 +1,26 @@ +--TEST-- +GH-12208 (SimpleXML infinite loop when a cast is used inside a foreach) +--EXTENSIONS-- +simplexml +--FILE-- +12"; +$xml = simplexml_load_string($xml); + +$a = $xml->a; + +foreach ($a as $test) { + var_dump((string) $a->current()); + var_dump((string) $a); + var_dump((bool) $a); +} + +?> +--EXPECT-- +string(1) "1" +string(1) "1" +bool(true) +string(1) "2" +string(1) "1" +bool(true)