archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 05:58:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix bug #72750: wddx_deserialize null dereference

Browse source
This commit is contained in:
Stanislav Malyshev 2016-08-07 16:26:52 -07:00
parent e018ff094f
commit 698a691724
2 changed files with 40 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

34
ext/wddx/tests/bug72750.phpt Normal file
View file

@ -0,0 +1,34 @@
--TEST--
Bug #72750: wddx_deserialize null dereference
--SKIPIF--
<?php
if (!extension_loaded('wddx')) {
die('skip. wddx not available');
}
?>
--FILE--
<?php
$xml = <<< XML
<?xml version='1.0'?>
<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
<wddxPacket version='1.0'>
<header/>
<data>
<struct>
<var name='aBinary'>
<binary length='11'>\\tYmluYXJRhdGE=</binary>
</var>
</struct>
</data>
</wddxPacket>
XML;
$array = wddx_deserialize($xml);
var_dump($array);
?>
--EXPECT--
array(1) {
["aBinary"]=>
string(0) ""
}

8
ext/wddx/wddx.c
View file

@ -959,8 +959,12 @@ static void php_wddx_pop_element(void *user_data, const XML_Char *name)
new_str = php_base64_decode(Z_STRVAL_P(ent1->data), Z_STRLEN_P(ent1->data), &new_len);
STR_FREE(Z_STRVAL_P(ent1->data));
Z_STRVAL_P(ent1->data) = new_str;
Z_STRLEN_P(ent1->data) = new_len;
if (new_str) {
Z_STRVAL_P(ent1->data) = new_str;
Z_STRLEN_P(ent1->data) = new_len;
} else {
ZVAL_EMPTY_STRING(ent1->data);
}
}
/* Call __wakeup() method on the object. */