Fix GH-12167 and GH-12169: Unable to get comment or processing instru…

…ction contents in SimpleXML

Closes GH-12289.

NEWS

@@ -35,6 +35,10 @@ PHP                                                                        NEWS
   . Fixed bug GH-12208 (SimpleXML infinite loop when a cast is used inside a
     foreach). (nielsdos)
   . Fixed bug #55098 (SimpleXML iteration produces infinite loop). (nielsdos)
+  . Fixed bug GH-12167 (Unable to get processing instruction contents in
+    SimpleXML). (nielsdos)
+  . Fixed bug GH-12169 (Unable to get comment contents in SimpleXML).
+    (nielsdos)
 
 - Streams:
   . Fixed bug GH-12190 (binding ipv4 address with both address and port at 0).

ext/simplexml/simplexml.c

@@ -1835,6 +1835,7 @@ static int sxe_object_cast_ex(zend_object *readobj, zval *writeobj, int type)
 {
 	php_sxe_object *sxe;
 	xmlChar        *contents = NULL;
+	bool            free_contents = true;
 	xmlNodePtr	    node;
 	int rv;
 
@@ -1865,13 +1866,16 @@ static int sxe_object_cast_ex(zend_object *readobj, zval *writeobj, int type)
 		if (sxe->node && sxe->node->node) {
 			if (sxe->node->node->children) {
 				contents = xmlNodeListGetString((xmlDocPtr) sxe->document->ptr, sxe->node->node->children, 1);
+			} else if (sxe->node->node->type == XML_COMMENT_NODE || sxe->node->node->type == XML_PI_NODE) {
+				contents = sxe->node->node->content;
+				free_contents = false;
 			}
 		}
 	}
 
 	rv = cast_object(writeobj, type, (char *)contents);
 
-	if (contents) {
+	if (contents && free_contents) {
 		xmlFree(contents);
 	}
 

ext/simplexml/tests/gh12167.phpt

@@ -0,0 +1,23 @@
+--TEST--
+GH-12167 (Unable to get processing instruction contents in SimpleXML)
+--EXTENSIONS--
+simplexml
+--FILE--
+<?php
+
+$xml = <<<XML
+<?xml version="1.0"?>
+<container>
+  <?foo pi contents ?>
+</container>
+XML;
+
+$sxe = simplexml_load_string($xml);
+
+var_dump($sxe->xpath("//processing-instruction()")[0]->getName());
+var_dump((string) $sxe->xpath("//processing-instruction()")[0]);
+
+?>
+--EXPECT--
+string(3) "foo"
+string(12) "pi contents "

ext/simplexml/tests/gh12169.phpt

@@ -0,0 +1,23 @@
+--TEST--
+GH-12169 (Unable to get comment contents in SimpleXML)
+--EXTENSIONS--
+simplexml
+--FILE--
+<?php
+
+$xml = <<<XML
+<?xml version="1.0"?>
+<container>
+    <!-- comment contents -->
+</container>
+XML;
+
+$sxe = simplexml_load_string($xml);
+
+var_dump($sxe->xpath("//comment()")[0]->getName());
+var_dump((string) $sxe->xpath("//comment()")[0]);
+
+?>
+--EXPECT--
+string(7) "comment"
+string(18) " comment contents "