Merge branch 'PHP-8.5' into PHP-8.6

* PHP-8.5:
  Fix GH-25268: clone of Dom\Notation NULL dereference

Author: devnexen

ext/dom/node.c

@@ -1533,6 +1533,10 @@ PHP_METHOD(DOMNode, cloneNode)
 		if (clone_document && private_data != NULL) {
 			php_dom_private_data_destroy(private_data);
 		}
+		if (instanceof_function(intern->std.ce, dom_modern_node_class_entry)) {
+			php_dom_throw_error(INVALID_STATE_ERR, /* strict */ true);
+			RETURN_THROWS();
+		}
 		RETURN_FALSE;
 	}
 

ext/dom/php_dom.c

@@ -660,9 +660,11 @@ static zend_object *dom_objects_store_clone_obj(zend_object *zobject) /* {{{ */
 			xmlNodePtr cloned_node = dom_clone_node(php_dom_ns_mapper_from_private(private_data), node, node->doc, true);
 			if (cloned_node != NULL) {
 				dom_update_refcount_after_clone(intern, node, clone, cloned_node);
-			}
-			if (private_data != NULL) {
-				clone->document->private_data = php_dom_libxml_private_data_header(private_data);
+				if (private_data != NULL) {
+					clone->document->private_data = php_dom_libxml_private_data_header(private_data);
+				}
+			} else if (private_data != NULL && (node->type == XML_DOCUMENT_NODE || node->type == XML_HTML_DOCUMENT_NODE)) {
+				php_dom_private_data_destroy(private_data);
 			}
 		}
 	}

ext/dom/tests/modern/xml/gh25268_declarations.phpt

@@ -0,0 +1,27 @@
+--TEST--
+GH-25268 (NULL php_libxml_ref_obj dereference in dom_objects_store_clone_obj when cloning DTD declarations)
+--EXTENSIONS--
+dom
+--FILE--
+<?php
+$dom = Dom\XMLDocument::createFromString('<!DOCTYPE root [<!ELEMENT root EMPTY><!ENTITY e "x">]><root/>');
+
+foreach ([$dom->doctype->entities->getNamedItem("e"), $dom->doctype->childNodes[0]] as $decl) {
+    $clone = clone $decl;
+    try {
+        var_dump($clone->nodeName);
+    } catch (DOMException $e) {
+        echo $e::class, ': ', $e->getMessage(), PHP_EOL;
+    }
+    try {
+        var_dump($decl->cloneNode());
+    } catch (DOMException $e) {
+        echo $e::class, ': ', $e->getMessage(), PHP_EOL;
+    }
+}
+?>
+--EXPECT--
+DOMException: Invalid State Error
+DOMException: Invalid State Error
+DOMException: Invalid State Error
+DOMException: Invalid State Error