Fixed bug #66084 simplexml_load_string() mangles empty node name

4 files changed, 90 insertions, 1 deletions

diff --git a/NEWS b/NEWS
index bf8d1d2a4d..fde89e9ca7 100644
--- a/NEWS
+++ b/NEWS
@@ -16,6 +16,10 @@ PHP                                                                        NEWS
   . Fixed bug #66987i (Memory corruption in fileinfo ext / bigendian).
     (Remi)
 
+- SimpleXML:
+  . Fixed bug #66084 (simplexml_load_string() mangles empty node name)
+    (Anatol)
+
 - XSL:
   . Fixed bug #53965 (<xsl:include> cannot find files with relative paths
     when loaded with "file://"). (Anatol)
diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c
index b9966ddcce..15a8512a43 100644
--- a/ext/simplexml/simplexml.c
+++ b/ext/simplexml/simplexml.c
@@ -1129,7 +1129,7 @@ static HashTable * sxe_get_prop_hash(zval *object, int is_debug TSRMLS_DC) /* {{
 			node = NULL;
 		} else if (sxe->iter.type != SXE_ITER_CHILD) {
 
-			if ( !node->children || !node->parent || node->children->next || node->children->children || node->parent->children == node->parent->last ) {
+			if ( !node->children || !node->parent || !node->next || node->children->next || node->children->children || node->parent->children == node->parent->last ) {
 				node = node->children;
 			} else {
 				iter_data = sxe->iter.data;
diff --git a/ext/simplexml/tests/bug66084_0.phpt b/ext/simplexml/tests/bug66084_0.phpt
new file mode 100644
index 0000000000..35f4daf876
--- /dev/null
+++ b/ext/simplexml/tests/bug66084_0.phpt
@@ -0,0 +1,68 @@
+--TEST--
+Bug #66084 simplexml_load_string() mangles empty node name, var_dump variant
+--SKIPIF--
+<?php if (!extension_loaded("simplexml")) print "skip simplexml not available"; ?>
+--FILE--
+<?php
+echo var_dump(simplexml_load_string('<a><b/><c><x/></c></a>')), "\n";
+echo var_dump(simplexml_load_string('<a><b/><d/><c><x/></c></a>')), "\n";
+echo var_dump(simplexml_load_string('<a><b/><c><d/><x/></c></a>')), "\n";
+echo var_dump(simplexml_load_string('<a><b/><c><d><x/></d></c></a>')), "\n";
+?>
+--EXPECT--
+object(SimpleXMLElement)#1 (2) {
+  ["b"]=>
+  object(SimpleXMLElement)#2 (0) {
+  }
+  ["c"]=>
+  object(SimpleXMLElement)#3 (1) {
+    ["x"]=>
+    object(SimpleXMLElement)#4 (0) {
+    }
+  }
+}
+
+object(SimpleXMLElement)#1 (3) {
+  ["b"]=>
+  object(SimpleXMLElement)#3 (0) {
+  }
+  ["d"]=>
+  object(SimpleXMLElement)#2 (0) {
+  }
+  ["c"]=>
+  object(SimpleXMLElement)#4 (1) {
+    ["x"]=>
+    object(SimpleXMLElement)#5 (0) {
+    }
+  }
+}
+
+object(SimpleXMLElement)#1 (2) {
+  ["b"]=>
+  object(SimpleXMLElement)#4 (0) {
+  }
+  ["c"]=>
+  object(SimpleXMLElement)#2 (2) {
+    ["d"]=>
+    object(SimpleXMLElement)#3 (0) {
+    }
+    ["x"]=>
+    object(SimpleXMLElement)#5 (0) {
+    }
+  }
+}
+
+object(SimpleXMLElement)#1 (2) {
+  ["b"]=>
+  object(SimpleXMLElement)#2 (0) {
+  }
+  ["c"]=>
+  object(SimpleXMLElement)#4 (1) {
+    ["d"]=>
+    object(SimpleXMLElement)#5 (1) {
+      ["x"]=>
+      object(SimpleXMLElement)#3 (0) {
+      }
+    }
+  }
+}
diff --git a/ext/simplexml/tests/bug66084_1.phpt b/ext/simplexml/tests/bug66084_1.phpt
new file mode 100644
index 0000000000..80e91df7c6
--- /dev/null
+++ b/ext/simplexml/tests/bug66084_1.phpt
@@ -0,0 +1,17 @@
+--TEST--
+Bug #66084 simplexml_load_string() mangles empty node name, json variant
+--SKIPIF--
+<?php if (!extension_loaded("simplexml")) print "skip simplexml not available"; ?>
+<?php if (!extension_loaded("json")) print "skip json not available"; ?>
+--FILE--
+<?php
+echo json_encode(simplexml_load_string('<a><b/><c><x/></c></a>')), "\n";
+echo json_encode(simplexml_load_string('<a><b/><d/><c><x/></c></a>')), "\n";
+echo json_encode(simplexml_load_string('<a><b/><c><d/><x/></c></a>')), "\n";
+echo json_encode(simplexml_load_string('<a><b/><c><d><x/></d></c></a>')), "\n";
+?>
+--EXPECT--
+{"b":{},"c":{"x":{}}}
+{"b":{},"d":{},"c":{"x":{}}}
+{"b":{},"c":{"d":{},"x":{}}}
+{"b":{},"c":{"d":{"x":{}}}}