fix negative values

Author: LamentXU123

NEWS

@@ -20,9 +20,9 @@ PHP                                                                        NEWS
 - DOM:
   . Fixed bug GH-22570 (Stack overflow when serializing a deeply nested
     Dom\XMLDocument). (iliaal)
-  . Fixed Dom\DtdNamedNodeMap dimension access to throw ValueError for indexes
-    outside the int range instead of overflowing while converting to int.
-    (Weilin Du)
+  . Fixed Dom\DtdNamedNodeMap integer dimension access so negative indexes
+    return NULL and indexes outside the int range throw ValueError instead of
+    returning the first entity or notation. (Weilin Du)
 
 - Exif:
   . Fixed bug GH-11020 (exif_read_data() emits a spurious "Illegal IFD size"

ext/dom/dom_iterators.c

@@ -83,6 +83,9 @@ xmlNodePtr php_dom_libxml_hash_iter(xmlHashTable *ht, zend_long index)
 {
 	int htsize;
 
+	if (index < 0) {
+		return NULL;
+	}
 	if (UNEXPECTED(ZEND_LONG_INT_OVFL(index))) {
 		zend_value_error("must be between 0 and %d", INT_MAX);
 		return NULL;

ext/dom/tests/modern/xml/DtdNamedNodeMap_dimension_index_overflow_64.phpt

@@ -1,5 +1,5 @@
 --TEST--
-Dom\DtdNamedNodeMap dimension access throws for indexes outside the int range
+Dom\DtdNamedNodeMap dimension access handles invalid integer indexes
 --EXTENSIONS--
 dom
 --SKIPIF--
@@ -28,10 +28,14 @@ function dump_access(Closure $callback): void {
     }
 }
 
+dump_access(fn() => $doc->doctype->entities[-1]);
 dump_access(fn() => $doc->doctype->entities[$overflow]);
 
+dump_access(fn() => $doc->doctype->notations[-1]);
 dump_access(fn() => $doc->doctype->notations[$overflow]);
 ?>
 --EXPECT--
+NULL
 must be between 0 and 2147483647
+NULL
 must be between 0 and 2147483647