diff --git a/NEWS b/NEWS
index 1b1908ab11346..4fa3d35c252a4 100644
--- a/NEWS
+++ b/NEWS
@@ -35,6 +35,10 @@ PHP NEWS
. Fixed bug GH-12208 (SimpleXML infinite loop when a cast is used inside a
foreach). (nielsdos)
. Fixed bug #55098 (SimpleXML iteration produces infinite loop). (nielsdos)
+ . Fixed bug GH-12167 (Unable to get processing instruction contents in
+ SimpleXML). (nielsdos)
+ . Fixed bug GH-12169 (Unable to get comment contents in SimpleXML).
+ (nielsdos)
- Streams:
. Fixed bug GH-12190 (binding ipv4 address with both address and port at 0).
diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c
index f08b4727ea7e9..c1c437fbf3a20 100644
--- a/ext/simplexml/simplexml.c
+++ b/ext/simplexml/simplexml.c
@@ -1835,6 +1835,7 @@ static zend_result sxe_object_cast_ex(zend_object *readobj, zval *writeobj, int
{
php_sxe_object *sxe;
xmlChar *contents = NULL;
+ bool free_contents = true;
xmlNodePtr node;
zend_result rv;
@@ -1865,13 +1866,16 @@ static zend_result sxe_object_cast_ex(zend_object *readobj, zval *writeobj, int
if (sxe->node && sxe->node->node) {
if (sxe->node->node->children) {
contents = xmlNodeListGetString((xmlDocPtr) sxe->document->ptr, sxe->node->node->children, 1);
+ } else if (sxe->node->node->type == XML_COMMENT_NODE || sxe->node->node->type == XML_PI_NODE) {
+ contents = sxe->node->node->content;
+ free_contents = false;
}
}
}
rv = cast_object(writeobj, type, (char *)contents);
- if (contents) {
+ if (contents && free_contents) {
xmlFree(contents);
}
diff --git a/ext/simplexml/tests/gh12167.phpt b/ext/simplexml/tests/gh12167.phpt
new file mode 100644
index 0000000000000..80ff496aa7e43
--- /dev/null
+++ b/ext/simplexml/tests/gh12167.phpt
@@ -0,0 +1,23 @@
+--TEST--
+GH-12167 (Unable to get processing instruction contents in SimpleXML)
+--EXTENSIONS--
+simplexml
+--FILE--
+
+
+
+
+XML;
+
+$sxe = simplexml_load_string($xml);
+
+var_dump($sxe->xpath("//processing-instruction()")[0]->getName());
+var_dump((string) $sxe->xpath("//processing-instruction()")[0]);
+
+?>
+--EXPECT--
+string(3) "foo"
+string(12) "pi contents "
diff --git a/ext/simplexml/tests/gh12169.phpt b/ext/simplexml/tests/gh12169.phpt
new file mode 100644
index 0000000000000..ca2d26b537636
--- /dev/null
+++ b/ext/simplexml/tests/gh12169.phpt
@@ -0,0 +1,23 @@
+--TEST--
+GH-12169 (Unable to get comment contents in SimpleXML)
+--EXTENSIONS--
+simplexml
+--FILE--
+
+
+
+
+XML;
+
+$sxe = simplexml_load_string($xml);
+
+var_dump($sxe->xpath("//comment()")[0]->getName());
+var_dump((string) $sxe->xpath("//comment()")[0]);
+
+?>
+--EXPECT--
+string(7) "comment"
+string(18) " comment contents "