Commit 4c955f4a2b2 for php.net
commit 4c955f4a2b2cbd2c711451536d2e00d9947435f0
Merge: 7c3c8d677bc 9e696413e89
Author: Ilia Alshanetsky <ilia@ilia.ws>
Date: Sun Aug 9 14:05:42 2026 -0400
Merge branch 'PHP-8.4' into PHP-8.5
* PHP-8.4:
Fix SimpleXML integer offsets that cannot resolve aliasing a node
diff --cc NEWS
index 7fcd21fbbdc,05e3a23118d..e99924f024e
--- a/NEWS
+++ b/NEWS
@@@ -62,9 -55,11 +62,13 @@@ PH
. Fixed bug GH-23043 (broken session id code can cause zend_mm_heap
corrupted). (ndossche)
+ - SimpleXML:
+ . Fixed integer element offsets that cannot resolve aliasing an existing
+ element. (iliaal)
+
- Sockets:
+ . Fixed socket_set_option() validation error messages for UDP_SEGMENT and
+ SO_LINGER options. (Weilin Du)
. Fixed various memory related issues in ext/sockets. (David Carlier)
- SQLite:
diff --cc ext/simplexml/simplexml.c
index 875be2b6e23,f3c1a073fca..e537bc3fb20
--- a/ext/simplexml/simplexml.c
+++ b/ext/simplexml/simplexml.c
@@@ -578,12 -589,16 +581,16 @@@ next_iter
newnode = xmlNewTextChild(mynode, NULL, (xmlChar *)Z_STRVAL_P(member), value_str ? (xmlChar *)ZSTR_VAL(value_str) : NULL);
}
} else if (!member || Z_TYPE_P(member) == IS_LONG) {
- if (member && cnt < Z_LVAL_P(member)) {
+ if (member && (Z_LVAL_P(member) < 0 || cnt < Z_LVAL_P(member))) {
php_error_docref(NULL, E_WARNING, "Cannot add element %s number " ZEND_LONG_FMT " when only " ZEND_LONG_FMT " such elements exist", mynode->name, Z_LVAL_P(member), cnt);
}
- newnode = xmlNewTextChild(mynode->parent, mynode->ns, mynode->name, value_str ? (xmlChar *)ZSTR_VAL(value_str) : NULL);
+ if (member && Z_LVAL_P(member) < 0) {
+ value = &EG(error_zval);
+ } else {
+ newnode = xmlNewTextChild(mynode->parent, mynode->ns, mynode->name, value_str ? (xmlChar *)ZSTR_VAL(value_str) : NULL);
+ }
}
- } else if (attribs) {
+ } else {
if (Z_TYPE_P(member) == IS_LONG) {
php_error_docref(NULL, E_WARNING, "Cannot change attribute number " ZEND_LONG_FMT " when only %d attributes exist", Z_LVAL_P(member), nodendx);
} else {