From 1d0fbdf449dbd4e7de3e4b9058ef88a723e9926c Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date: Wed, 9 Oct 2024 18:11:22 +0200
Subject: [PATCH] Fix GH-16316: DOMXPath breaks when not initialized properly

Closes GH-16330.
---
 NEWS                       |  4 ++++
 ext/dom/tests/gh16316.phpt | 32 ++++++++++++++++++++++++++++++++
 ext/dom/xpath.c            |  5 +++++
 3 files changed, 41 insertions(+)
 create mode 100644 ext/dom/tests/gh16316.phpt

diff --git a/NEWS b/NEWS
index 2862a32167201..4b89844e033ae 100644
--- a/NEWS
+++ b/NEWS
@@ -9,6 +9,10 @@ PHP                                                                        NEWS
   . Fixed bug GH-16302 (CurlMultiHandle holds a reference to CurlHandle if
     curl_multi_add_handle fails). (timwolla)
 
+- DOM:
+  . Fixed bug GH-16316 (DOMXPath breaks when not initialized properly).
+    (nielsdos)
+
 - PHPDBG:
   . Fixed bug GH-16174 (Empty string is an invalid expression for ev). (cmb)
 
diff --git a/ext/dom/tests/gh16316.phpt b/ext/dom/tests/gh16316.phpt
new file mode 100644
index 0000000000000..43368746bc462
--- /dev/null
+++ b/ext/dom/tests/gh16316.phpt
@@ -0,0 +1,32 @@
+--TEST--
+GH-16316 (DOMXPath breaks when not initialized properly)
+--EXTENSIONS--
+dom
+--FILE--
+<?php
+
+class Demo extends DOMXPath {
+    public function __construct() {}
+}
+
+$demo = new Demo;
+try {
+    var_dump($demo);
+} catch (DOMException $e) {
+    echo $e->getMessage(), "\n";
+}
+
+try {
+    var_dump($demo->document);
+} catch (DOMException $e) {
+    echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+object(Demo)#1 (1) {
+  ["registerNodeNamespaces"]=>
+  bool(true)
+}
+Invalid State Error
+Invalid State Error
diff --git a/ext/dom/xpath.c b/ext/dom/xpath.c
index 22a7e0ecc5a91..cad08e0a8d8a6 100644
--- a/ext/dom/xpath.c
+++ b/ext/dom/xpath.c
@@ -264,6 +264,11 @@ int dom_xpath_document_read(dom_object *obj, zval *retval)
 		docp = (xmlDocPtr) ctx->doc;
 	}
 
+	if (UNEXPECTED(!docp)) {
+		php_dom_throw_error(INVALID_STATE_ERR, /* strict */ true);
+		return FAILURE;
+	}
+
 	php_dom_create_object((xmlNodePtr) docp, retval, obj);
 	return SUCCESS;
 }