Fix GH-21544: Dom\XMLDocument::C14N() drops namespace declarations on DOM-built documents.

For programmatically built documents (e.g. createElementNS), namespaces
live on node->ns without corresponding xmlns attributes. Create temporary
synthetic nsDef entries so C14N can find them, complementing the existing
xmlns attribute to nsDef conversion.

Author: devnexen

ext/dom/node.c

@@ -2103,6 +2103,38 @@ PHP_METHOD(DOMNode, lookupNamespaceURI)
 }
 /* }}} end dom_node_lookup_namespace_uri */
 
+/* For DOM-built documents (e.g. createElementNS), namespaces live on node->ns
+ * without corresponding xmlns attributes. C14N expects nsDef entries, so create
+ * temporary ones. The _private field stays NULL to distinguish from attr-based
+ * entries during cleanup. */
+static void dom_add_synthetic_ns_decl(HashTable *links, xmlNodePtr node, xmlNsPtr src_ns)
+{
+	for (xmlNsPtr existing = node->nsDef; existing; existing = existing->next) {
+		if (xmlStrEqual(existing->prefix, src_ns->prefix)) {
+			return;
+		}
+	}
+
+	xmlNsPtr ns = xmlMalloc(sizeof(*ns));
+	if (!ns) {
+		return;
+	}
+
+	zval *zv = zend_hash_index_lookup(links, (zend_ulong) node);
+	if (Z_ISNULL_P(zv)) {
+		ZVAL_LONG(zv, 1);
+	} else {
+		Z_LVAL_P(zv)++;
+	}
+
+	memset(ns, 0, sizeof(*ns));
+	ns->type = XML_LOCAL_NAMESPACE;
+	ns->href = xmlStrdup(src_ns->href);
+	ns->prefix = src_ns->prefix ? xmlStrdup(src_ns->prefix) : NULL;
+	ns->next = node->nsDef;
+	node->nsDef = ns;
+}
+
 static void dom_relink_ns_decls_element(HashTable *links, xmlNodePtr node)
 {
 	if (node->type == XML_ELEMENT_NODE) {
@@ -2142,6 +2174,15 @@ static void dom_relink_ns_decls_element(HashTable *links, xmlNodePtr node)
 			}
 		}
 
+		if (node->ns) {
+			dom_add_synthetic_ns_decl(links, node, node->ns);
+		}
+		for (xmlAttrPtr attr = node->properties; attr; attr = attr->next) {
+			if (attr->ns && !php_dom_ns_is_fast((const xmlNode *) attr, php_dom_ns_is_xmlns_magic_token)) {
+				dom_add_synthetic_ns_decl(links, node, attr->ns);
+			}
+		}
+
 		/* The default namespace is handled separately from the other namespaces in C14N.
 		 * The default namespace is explicitly looked up while the other namespaces are
 		 * deduplicated and compared to a list of visible namespaces. */
@@ -2179,13 +2220,15 @@ static void dom_unlink_ns_decls(HashTable *links)
 				node->nsDef = ns->next;
 
 				xmlAttrPtr attr = ns->_private;
-				if (attr->prev) {
-					attr->prev->next = attr;
-				} else {
-					node->properties = attr;
-				}
-				if (attr->next) {
-					attr->next->prev = attr;
+				if (attr) {
+					if (attr->prev) {
+						attr->prev->next = attr;
+					} else {
+						node->properties = attr;
+					}
+					if (attr->next) {
+						attr->next->prev = attr;
+					}
 				}
 
 				xmlFreeNs(ns);

ext/dom/tests/modern/xml/gh21544.phpt

@@ -0,0 +1,28 @@
+--TEST--
+GH-21544 (Dom\XMLDocument::C14N() drops namespace declarations on DOM-built documents)
+--CREDITS--
+Toon Verwerft (veewee)
+--EXTENSIONS--
+dom
+--FILE--
+<?php
+
+$doc = Dom\XMLDocument::createEmpty();
+$root = $doc->createElementNS("urn:envelope", "env:Root");
+$doc->appendChild($root);
+$child = $doc->createElementNS("urn:child", "x:Child");
+$root->appendChild($child);
+
+$parsed = Dom\XMLDocument::createFromString(
+    '<env:Root xmlns:env="urn:envelope"><x:Child xmlns:x="urn:child"/></env:Root>'
+);
+
+echo "DOM-built C14N: " . $doc->C14N() . PHP_EOL;
+echo "Parsed C14N:    " . $parsed->C14N() . PHP_EOL;
+var_dump($doc->C14N() === $parsed->C14N());
+
+?>
+--EXPECT--
+DOM-built C14N: <env:Root xmlns:env="urn:envelope"><x:Child xmlns:x="urn:child"></x:Child></env:Root>
+Parsed C14N:    <env:Root xmlns:env="urn:envelope"><x:Child xmlns:x="urn:child"></x:Child></env:Root>
+bool(true)