Fix crash when calling childNodes next() when iterator is exhausted

Closes GH-14091.

Author: ndossche

NEWS

@@ -6,6 +6,8 @@ PHP                                                                        NEWS
   . Fix crashes when entity declaration is removed while still having entity
     references. (nielsdos)
   . Fix references not handled correctly in C14N. (nielsdos)
+  . Fix crash when calling childNodes next() when iterator is exhausted.
+    (nielsdos)
 
 09 May 2024, PHP 8.2.19
 

ext/dom/dom_iterators.c

@@ -147,8 +147,7 @@ static int php_dom_iterator_valid(zend_object_iterator *iter) /* {{{ */
 zval *php_dom_iterator_current_data(zend_object_iterator *iter) /* {{{ */
 {
 	php_dom_iterator *iterator = (php_dom_iterator *)iter;
-
-	return &iterator->curobj;
+	return Z_ISUNDEF(iterator->curobj) ? NULL : &iterator->curobj;
 }
 /* }}} */
 

ext/dom/tests/childNodes_current_crash.phpt

@@ -0,0 +1,25 @@
+--TEST--
+Crash in childNodes iterator current()
+--EXTENSIONS--
+dom
+--FILE--
+<?php
+
+$dom = new DOMDocument;
+$dom->loadXML('<foo>foo1</foo>');
+
+$nodes = $dom->documentElement->childNodes;
+$iter = $nodes->getIterator();
+
+var_dump($iter->valid());
+var_dump($iter->current()?->wholeText);
+$iter->next();
+var_dump($iter->valid());
+var_dump($iter->current()?->wholeText);
+
+?>
+--EXPECT--
+bool(true)
+string(4) "foo1"
+bool(false)
+NULL