member access within null pointer in simplexml.c:1864

[chongwick]

Description

The following code:

<?php
function processVar($var) {
    if (is_object($var)) {
        return (string)$var;
    } elseif (is_array($var)) {
        return implode(',', array_map('processVar', $var));
    } else {
        return $var;
    }
}

function varFusion($var1, $var2, $var3) {
    $vars = array($var1, $var2, $var3);
    foreach ($vars as $i => $v1) {
        foreach ($vars as $j => $v2) {
            if ($i < $j) {
                $result["concat_{$i}_{$j}"] = processVar($v1).''. processVar($v2);
            }
        }
    }
    return $result;
}

$xml = '<?xml version="1.0" encoding="utf-8"?>
<test>
</test>';
$root = simplexml_load_string($xml);
$clone = clone $root;
$script1_dataflow = $clone;
$script1_connect = $clone;

class foo {
    public function __construct($n = 0) {
    }
}

try {
    $y = $script1_dataflow->__construct(1);
} catch (Exception $e) {
}

varFusion($script1_connect, $script2_connect, $random_var);
?>

Resulted in this output:

/home/dan/php-8.3.9/ext/simplexml/simplexml.c:1864:62: runtime error: member access within null pointer of type 'struct php_libxml_ref_obj'

But I expected this output instead:

PHP Version

8.3.9

Operating System

No response

[DanielEScherzer]

With the latest version of PHP 8.3 (cd67c09):

root@05457a5cfa7f:/usr/src/php# php /var/www/html/test.php 

Warning: SimpleXMLElement::__construct(): Entity: line 1: parser error : Start tag expected, '<' not found in /var/www/html/test.php on line 38

Warning: SimpleXMLElement::__construct(): 1 in /var/www/html/test.php on line 38

Warning: SimpleXMLElement::__construct(): ^ in /var/www/html/test.php on line 38

Warning: Undefined variable $script2_connect in /var/www/html/test.php on line 42

Warning: Undefined variable $random_var in /var/www/html/test.php on line 42

[DanielEScherzer]

This is similar to #14638 which was merged into PHP 8.3 as 20866b3

[cmb69]

Thanks again @DanielEScherzer!

@chongwick, please try again with PHP 8.3.12.

[nielsdos]

@DanielEScherzer is right (thanks!), this is indeed a duplicate of GH-14638, closing as such.