From b599b94bee5f508da3c42c8fa5d02bebce583bcc Mon Sep 17 00:00:00 2001
From: 609bob <1850029304@qq.com>
Date: Sun, 4 Jan 2026 20:07:46 +0800
Subject: [PATCH] fix: null pointer dereference and memory leak

CLA: trivial
---
 ext/dom/php_dom.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/ext/dom/php_dom.c b/ext/dom/php_dom.c
index a39e5c1656e9e..1bc14128b7721 100644
--- a/ext/dom/php_dom.c
+++ b/ext/dom/php_dom.c
@@ -648,9 +648,11 @@ static zend_object *dom_objects_store_clone_obj(zend_object *zobject) /* {{{ */
 		xmlNodePtr node = (xmlNodePtr)dom_object_get_node(intern);
 		if (node != NULL) {
 			php_dom_private_data *private_data = NULL;
+			bool private_data_created = false;
 			if (php_dom_follow_spec_intern(intern)) {
 				if (node->type == XML_DOCUMENT_NODE || node->type == XML_HTML_DOCUMENT_NODE) {
 					private_data = php_dom_private_data_create();
+					private_data_created = true;
 				} else {
 					private_data = php_dom_get_private_data(intern);
 				}
@@ -659,9 +661,13 @@ static zend_object *dom_objects_store_clone_obj(zend_object *zobject) /* {{{ */
 			xmlNodePtr cloned_node = dom_clone_node(php_dom_ns_mapper_from_private(private_data), node, node->doc, true);
 			if (cloned_node != NULL) {
 				dom_update_refcount_after_clone(intern, node, clone, cloned_node);
-			}
-			if (private_data != NULL) {
-				clone->document->private_data = php_dom_libxml_private_data_header(private_data);
+				if (private_data != NULL && clone->document != NULL) {
+					clone->document->private_data = php_dom_libxml_private_data_header(private_data);
+				}
+			} else {
+				if (private_data_created && private_data != NULL) {
+					php_dom_private_data_destroy(private_data);
+				}
 			}
 		}
 	}