I don't see how this can be a NULL pointer dereference or memory leak? php_dom_private_data_create never fails and therefore never returns NULL. EDIT: and also clone->document shouldn't be NULL.

the emalloc() call could theoretically return NULL in extreme memory conditions

That's false

Looking at dom_update_refcount_after_clone(), clone->document is only set when cloned_node->doc == original_node->doc.

You're misunderstanding the code. The document proxy is copied if the source and target document are the same, otherwise a new one is set.

The original code had a memory leak - when dom_clone_node() fails but private_data was newly created, it would never be destroyed. The fix ensures proper cleanup in the failure path.

That's false because the private data is still attached to the document proxy.

Is this AI?