From d7f157551435985eca65b79b44f23f1fd3ac7739 Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date: Fri, 25 Oct 2024 19:11:59 +0200
Subject: [PATCH] Fix GH-16594: Assertion failure in DOM -> before

The invalid parent condition can actually happen because PHP's DOM is
allows to get children of e.g. attributes; something normally not
possible.
---
 ext/dom/parentnode/tree.c  |  7 +++++--
 ext/dom/tests/gh16594.phpt | 25 +++++++++++++++++++++++++
 2 files changed, 30 insertions(+), 2 deletions(-)
 create mode 100644 ext/dom/tests/gh16594.phpt

diff --git a/ext/dom/parentnode/tree.c b/ext/dom/parentnode/tree.c
index ef1ad42b68c86..51cdd7cff43fc 100644
--- a/ext/dom/parentnode/tree.c
+++ b/ext/dom/parentnode/tree.c
@@ -239,8 +239,11 @@ static bool dom_is_pre_insert_valid_without_step_1(php_libxml_ref_obj *document,
 	ZEND_ASSERT(parentNode != NULL);
 
 	/* 1. If parent is not a Document, DocumentFragment, or Element node, then throw a "HierarchyRequestError" DOMException.
-	 *    => Impossible */
-	ZEND_ASSERT(!php_dom_pre_insert_is_parent_invalid(parentNode));
+	 *    => This is possible because we can grab children of attributes etc... (see e.g. GH-16594) */
+	if (php_dom_pre_insert_is_parent_invalid(parentNode)) {
+		php_dom_throw_error(HIERARCHY_REQUEST_ERR, dom_get_strict_error(document));
+		return false;
+	}
 
 	if (node->doc != documentNode) {
 		php_dom_throw_error(WRONG_DOCUMENT_ERR, dom_get_strict_error(document));
diff --git a/ext/dom/tests/gh16594.phpt b/ext/dom/tests/gh16594.phpt
new file mode 100644
index 0000000000000..adfde5948eefb
--- /dev/null
+++ b/ext/dom/tests/gh16594.phpt
@@ -0,0 +1,25 @@
+--TEST--
+GH-16594 (Assertion failure in DOM -> before)
+--EXTENSIONS--
+dom
+--FILE--
+<?php
+
+$v1 = new DOMText("wr");
+$v2 = new DOMDocument();
+$v6 = new DOMComment("aw");
+$v7 = new DOMAttr("r", "iL");
+
+$v9 = $v2->createElement("test");
+$v9->setAttributeNodeNS($v7);
+$v7->appendChild($v1);
+
+try {
+    $v1->before($v6);
+} catch (DOMException $e) {
+    echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+Hierarchy Request Error