Reject embedded NUL in SimpleXMLElement path/URL constructor

When dataIsURL is true, __construct parsed the path as a plain string
and passed it to xmlReadFile, so an embedded NUL truncated the path.
simplexml_load_file already rejects NULs via the path parameter type.
Match that check before xmlReadFile.

Author: iliaal

NEWS

@@ -42,6 +42,10 @@ PHP                                                                        NEWS
   . Fixed bug GH-23043 (broken session id code can cause zend_mm_heap
     corrupted). (ndossche)
 
+- SimpleXML:
+  . Fixed SimpleXMLElement::__construct() accepting embedded null bytes in
+    URL/path mode. (iliaal)
+
 - Sockets:
   . Fixed various memory related issues in ext/sockets. (David Carlier)
 

ext/simplexml/simplexml.c

@@ -2334,6 +2334,11 @@ PHP_METHOD(SimpleXMLElement, __construct)
 		RETURN_THROWS();
 	}
 
+	if (is_url && CHECK_NULL_PATH(data, data_len)) {
+		zend_argument_value_error(1, "must not contain any null bytes");
+		RETURN_THROWS();
+	}
+
 	PHP_LIBXML_SANITIZE_GLOBALS(read_file_or_memory);
 	docp = is_url ? xmlReadFile(data, NULL, (int)options) : xmlReadMemory(data, (int)data_len, NULL, NULL, (int)options);
 	PHP_LIBXML_RESTORE_GLOBALS(read_file_or_memory);

ext/simplexml/tests/bug_sxe_ctor_nul_path.phpt

@@ -0,0 +1,26 @@
+--TEST--
+SimpleXMLElement constructor rejects embedded NUL in URL/path mode
+--EXTENSIONS--
+simplexml
+--FILE--
+<?php
+$tmp = tempnam(sys_get_temp_dir(), 'sxe');
+file_put_contents($tmp, '<r/>');
+$path = $tmp . "\0evil";
+try {
+    new SimpleXMLElement($path, 0, true);
+    echo "ctor: loaded\n";
+} catch (Throwable $e) {
+    echo $e::class, ": ", $e->getMessage(), "\n";
+}
+try {
+    simplexml_load_file($path);
+    echo "load_file: loaded\n";
+} catch (Throwable $e) {
+    echo $e::class, ": ", $e->getMessage(), "\n";
+}
+unlink($tmp);
+?>
+--EXPECT--
+ValueError: SimpleXMLElement::__construct(): Argument #1 ($data) must not contain any null bytes
+ValueError: simplexml_load_file(): Argument #1 ($filename) must not contain any null bytes