diff --git a/ext/wddx/tests/bug72750.phpt b/ext/wddx/tests/bug72750.phpt new file mode 100644 index 0000000000000..3a6794df2803f --- /dev/null +++ b/ext/wddx/tests/bug72750.phpt @@ -0,0 +1,34 @@ +--TEST-- +Bug #72750: wddx_deserialize null dereference +--SKIPIF-- + +--FILE-- + + + +
+ + + + \\tYmluYXJRhdGE= + + + + +XML; + +$array = wddx_deserialize($xml); +var_dump($array); +?> +--EXPECT-- +array(1) { + ["aBinary"]=> + string(0) "" +} diff --git a/ext/wddx/wddx.c b/ext/wddx/wddx.c index faadbfe1dfe3d..1b2d103af18e3 100644 --- a/ext/wddx/wddx.c +++ b/ext/wddx/wddx.c @@ -959,8 +959,12 @@ static void php_wddx_pop_element(void *user_data, const XML_Char *name) new_str = php_base64_decode(Z_STRVAL_P(ent1->data), Z_STRLEN_P(ent1->data), &new_len); STR_FREE(Z_STRVAL_P(ent1->data)); - Z_STRVAL_P(ent1->data) = new_str; - Z_STRLEN_P(ent1->data) = new_len; + if (new_str) { + Z_STRVAL_P(ent1->data) = new_str; + Z_STRLEN_P(ent1->data) = new_len; + } else { + ZVAL_EMPTY_STRING(ent1->data); + } } /* Call __wakeup() method on the object. */