diff --git a/ext/dom/element.c b/ext/dom/element.c index 46f1100a767da..0b4117fb08ea0 100644 --- a/ext/dom/element.c +++ b/ext/dom/element.c @@ -339,7 +339,11 @@ PHP_METHOD(DOMElement, getAttributeNames) for (xmlNsPtr nsptr = nodep->nsDef; nsptr; nsptr = nsptr->next) { const char *prefix = (const char *) nsptr->prefix; - ZVAL_STR(&tmp, dom_node_concatenated_name_helper(strlen(prefix), prefix, strlen("xmlns"), (const char *) "xmlns")); + if (prefix == NULL) { + ZVAL_STRING(&tmp, "xmlns"); + } else { + ZVAL_STR(&tmp, dom_node_concatenated_name_helper(strlen(prefix), prefix, strlen("xmlns"), (const char *) "xmlns")); + } zend_hash_next_index_insert(ht, &tmp); } diff --git a/ext/dom/tests/gh16149.phpt b/ext/dom/tests/gh16149.phpt new file mode 100644 index 0000000000000..c6e1140e75ffe --- /dev/null +++ b/ext/dom/tests/gh16149.phpt @@ -0,0 +1,14 @@ +--TEST-- +GH-16149 (Null pointer dereference in DOMElement->getAttributeNames()) +--EXTENSIONS-- +dom +--FILE-- +getAttributeNames()); +?> +--EXPECT-- +array(1) { + [0]=> + string(5) "xmlns" +}