diff --git a/NEWS b/NEWS index e82a54e150b..cfa0935c8d0 100644 --- a/NEWS +++ b/NEWS @@ -19,6 +19,10 @@ PHP NEWS . Fixed bug GH-13773 (DatePeriod not taking into account microseconds for end date). (Mark Bennewitz, Derick) +- DOM: + . Fixed bug GH-15551 (Segmentation fault (access null pointer) in + ext/dom/xml_common.h). (nielsdos) + - MySQLnd: . Fixed bug GH-15432 (Heap corruption when querying a vector). (cmb, Kamil Tekiela) diff --git a/ext/dom/dom_iterators.c b/ext/dom/dom_iterators.c index a89da6d5431..378e841137f 100644 --- a/ext/dom/dom_iterators.c +++ b/ext/dom/dom_iterators.c @@ -164,13 +164,15 @@ static void php_dom_iterator_move_forward(zend_object_iterator *iter) /* {{{ */ xmlNodePtr curnode = NULL; php_dom_iterator *iterator = (php_dom_iterator *)iter; + if (Z_ISUNDEF(iterator->curobj)) { + return; + } + dom_object *intern = Z_DOMOBJ_P(&iterator->curobj); zval *object = &iterator->intern.data; dom_object *nnmap = Z_DOMOBJ_P(object); dom_nnodemap_object *objmap = nnmap->ptr; - dom_object *intern = Z_DOMOBJ_P(&iterator->curobj); - if (intern != NULL && intern->ptr != NULL) { if (objmap->nodetype != XML_ENTITY_NODE && objmap->nodetype != XML_NOTATION_NODE) { diff --git a/ext/dom/tests/gh15551.phpt b/ext/dom/tests/gh15551.phpt new file mode 100644 index 00000000000..3b4b7d4e857 --- /dev/null +++ b/ext/dom/tests/gh15551.phpt @@ -0,0 +1,14 @@ +--TEST-- +GH-15551 (Segmentation fault (access null pointer) in ext/dom/xml_common.h) +--EXTENSIONS-- +dom +--FILE-- +childNodes; +$iter = $nodes->getIterator(); +$iter->next(); +var_dump($iter->valid()); +?> +--EXPECT-- +bool(false)