From 82a84d0b7bf11864d6deae25f38b6e65642a2f8b Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date: Sat, 23 Sep 2023 23:07:30 +0200
Subject: [PATCH] Fix GH-12167 and GH-12169: Unable to get comment or
 processing instruction contents in SimpleXML

Closes GH-12289.
---
 NEWS                             |  4 ++++
 ext/simplexml/simplexml.c        |  6 +++++-
 ext/simplexml/tests/gh12167.phpt | 23 +++++++++++++++++++++++
 ext/simplexml/tests/gh12169.phpt | 23 +++++++++++++++++++++++
 4 files changed, 55 insertions(+), 1 deletion(-)
 create mode 100644 ext/simplexml/tests/gh12167.phpt
 create mode 100644 ext/simplexml/tests/gh12169.phpt

diff --git a/NEWS b/NEWS
index 9384a7fb473..22ccf6af0ed 100644
--- a/NEWS
+++ b/NEWS
@@ -35,6 +35,10 @@ PHP                                                                        NEWS
   . Fixed bug GH-12208 (SimpleXML infinite loop when a cast is used inside a
     foreach). (nielsdos)
   . Fixed bug #55098 (SimpleXML iteration produces infinite loop). (nielsdos)
+  . Fixed bug GH-12167 (Unable to get processing instruction contents in
+    SimpleXML). (nielsdos)
+  . Fixed bug GH-12169 (Unable to get comment contents in SimpleXML).
+    (nielsdos)
 
 - Streams:
   . Fixed bug GH-12190 (binding ipv4 address with both address and port at 0).
diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c
index 31461014d83..5622fbf47fd 100644
--- a/ext/simplexml/simplexml.c
+++ b/ext/simplexml/simplexml.c
@@ -1835,6 +1835,7 @@ static int sxe_object_cast_ex(zend_object *readobj, zval *writeobj, int type)
 {
 	php_sxe_object *sxe;
 	xmlChar        *contents = NULL;
+	bool            free_contents = true;
 	xmlNodePtr	    node;
 	int rv;
 
@@ -1865,13 +1866,16 @@ static int sxe_object_cast_ex(zend_object *readobj, zval *writeobj, int type)
 		if (sxe->node && sxe->node->node) {
 			if (sxe->node->node->children) {
 				contents = xmlNodeListGetString((xmlDocPtr) sxe->document->ptr, sxe->node->node->children, 1);
+			} else if (sxe->node->node->type == XML_COMMENT_NODE || sxe->node->node->type == XML_PI_NODE) {
+				contents = sxe->node->node->content;
+				free_contents = false;
 			}
 		}
 	}
 
 	rv = cast_object(writeobj, type, (char *)contents);
 
-	if (contents) {
+	if (contents && free_contents) {
 		xmlFree(contents);
 	}
 
diff --git a/ext/simplexml/tests/gh12167.phpt b/ext/simplexml/tests/gh12167.phpt
new file mode 100644
index 00000000000..80ff496aa7e
--- /dev/null
+++ b/ext/simplexml/tests/gh12167.phpt
@@ -0,0 +1,23 @@
+--TEST--
+GH-12167 (Unable to get processing instruction contents in SimpleXML)
+--EXTENSIONS--
+simplexml
+--FILE--
+<?php
+
+$xml = <<<XML
+<?xml version="1.0"?>
+<container>
+  <?foo pi contents ?>
+</container>
+XML;
+
+$sxe = simplexml_load_string($xml);
+
+var_dump($sxe->xpath("//processing-instruction()")[0]->getName());
+var_dump((string) $sxe->xpath("//processing-instruction()")[0]);
+
+?>
+--EXPECT--
+string(3) "foo"
+string(12) "pi contents "
diff --git a/ext/simplexml/tests/gh12169.phpt b/ext/simplexml/tests/gh12169.phpt
new file mode 100644
index 00000000000..ca2d26b5376
--- /dev/null
+++ b/ext/simplexml/tests/gh12169.phpt
@@ -0,0 +1,23 @@
+--TEST--
+GH-12169 (Unable to get comment contents in SimpleXML)
+--EXTENSIONS--
+simplexml
+--FILE--
+<?php
+
+$xml = <<<XML
+<?xml version="1.0"?>
+<container>
+    <!-- comment contents -->
+</container>
+XML;
+
+$sxe = simplexml_load_string($xml);
+
+var_dump($sxe->xpath("//comment()")[0]->getName());
+var_dump((string) $sxe->xpath("//comment()")[0]);
+
+?>
+--EXPECT--
+string(7) "comment"
+string(18) " comment contents "