From 15813d69a560b2791ddf82107a54353520d3a885 Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date: Fri, 10 May 2024 15:17:29 +0200
Subject: [PATCH] Fix GH-14183: XMLReader::open() can't be overridden

We should only return the override if the internal static method is matched.

Closes GH-14194.
---
 NEWS                             |  3 +++
 ext/xmlreader/php_xmlreader.c    | 22 ++++++++++------------
 ext/xmlreader/tests/gh14183.phpt | 24 ++++++++++++++++++++++++
 3 files changed, 37 insertions(+), 12 deletions(-)
 create mode 100644 ext/xmlreader/tests/gh14183.phpt

diff --git a/NEWS b/NEWS
index 961dcffcb5d..69231fb8c2c 100644
--- a/NEWS
+++ b/NEWS
@@ -29,6 +29,9 @@ PHP                                                                        NEWS
   . Fixed bug GH-14124 (Segmentation fault with XML extension under certain
     memory limit). (nielsdos)
 
+- XMLReader:
+  . Fixed bug GH-14183 (XMLReader::open() can't be overridden). (nielsdos)
+
 09 May 2024, PHP 8.2.19
 
 - Core:
diff --git a/ext/xmlreader/php_xmlreader.c b/ext/xmlreader/php_xmlreader.c
index 3f88f758ba7..1b4bc6bcef4 100644
--- a/ext/xmlreader/php_xmlreader.c
+++ b/ext/xmlreader/php_xmlreader.c
@@ -186,19 +186,17 @@ zval *xmlreader_write_property(zend_object *object, zend_string *name, zval *val
 /* {{{ */
 static zend_function *xmlreader_get_method(zend_object **obj, zend_string *name, const zval *key)
 {
-	if (ZSTR_LEN(name) == sizeof("open") - 1
-			&& (ZSTR_VAL(name)[0] == 'o' || ZSTR_VAL(name)[0] == 'O')
-			&& (ZSTR_VAL(name)[1] == 'p' || ZSTR_VAL(name)[1] == 'P')
-			&& (ZSTR_VAL(name)[2] == 'e' || ZSTR_VAL(name)[2] == 'E')
-			&& (ZSTR_VAL(name)[3] == 'n' || ZSTR_VAL(name)[3] == 'N')) {
-		return (zend_function*)&xmlreader_open_fn;
-	} else if (ZSTR_LEN(name) == sizeof("xml") - 1
-			&& (ZSTR_VAL(name)[0] == 'x' || ZSTR_VAL(name)[0] == 'X')
-			&& (ZSTR_VAL(name)[1] == 'm' || ZSTR_VAL(name)[1] == 'M')
-			&& (ZSTR_VAL(name)[2] == 'l' || ZSTR_VAL(name)[2] == 'L')) {
-		return (zend_function*)&xmlreader_xml_fn;
+	zend_function *method = zend_std_get_method(obj, name, key);
+	if (method && (method->common.fn_flags & ZEND_ACC_STATIC) && method->common.type == ZEND_INTERNAL_FUNCTION) {
+		/* There are only two static internal methods and they both have overrides. */
+		if (ZSTR_LEN(name) == sizeof("xml") - 1) {
+			return (zend_function *) &xmlreader_xml_fn;
+		} else {
+			ZEND_ASSERT(ZSTR_LEN(name) == sizeof("open") - 1);
+			return (zend_function *) &xmlreader_open_fn;
+		}
 	}
-	return zend_std_get_method(obj, name, key);;
+	return method;
 }
 /* }}} */
 
diff --git a/ext/xmlreader/tests/gh14183.phpt b/ext/xmlreader/tests/gh14183.phpt
new file mode 100644
index 00000000000..2f3f81bd662
--- /dev/null
+++ b/ext/xmlreader/tests/gh14183.phpt
@@ -0,0 +1,24 @@
+--TEST--
+GH-14183 (XMLReader::open() can't be overridden)
+--EXTENSIONS--
+xmlreader
+--FILE--
+<?php
+class MyXMLReader extends XMLReader
+{
+    public static function open(string $uri, string $encoding = null, int $flags = 0): bool|\XMLReader
+    {
+        echo 'overridden', PHP_EOL;
+        return true;
+    }
+}
+
+var_dump(MyXMLReader::open('asdf'));
+$o = new MyXMLReader;
+var_dump($o->open('asdf'));
+?>
+--EXPECT--
+overridden
+bool(true)
+overridden
+bool(true)