Skip to content

Commit 0c8a2a2

Browse files
smalyshevweltling
authored andcommitted
Fix for bug #72790 and bug #72799
(cherry picked from commit a14fdb9) Conflicts: ext/wddx/wddx.c
1 parent 67d0fe3 commit 0c8a2a2

File tree

3 files changed

+64
-1
lines changed

3 files changed

+64
-1
lines changed

Diff for: ext/wddx/tests/bug72790.phpt

+35
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
--TEST--
2+
Bug 72790: wddx_deserialize null dereference with invalid xml
3+
--SKIPIF--
4+
<?php
5+
if (!extension_loaded('wddx')) {
6+
die('skip. wddx not available');
7+
}
8+
?>
9+
--FILE--
10+
<?php
11+
12+
$xml = <<< XML
13+
<?xml version='1.0' ?>
14+
<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
15+
<wddxPacket version='1.0'>
16+
|array>
17+
<var name="XXXX">
18+
<boolean value="this">
19+
</boolean>
20+
</var>
21+
<var name="YYYY">
22+
<var name="UUUU">
23+
<var name="EZEZ">
24+
</var>
25+
</var>
26+
</var>
27+
</array>
28+
</wddxPacket>
29+
XML;
30+
31+
$array = wddx_deserialize($xml);
32+
var_dump($array);
33+
?>
34+
--EXPECT--
35+
NULL

Diff for: ext/wddx/tests/bug72799.phpt

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
--TEST--
2+
Bug #72799: wddx_deserialize null dereference in php_wddx_pop_element
3+
--SKIPIF--
4+
<?php
5+
if (!extension_loaded('wddx')) {
6+
die('skip. wddx not available');
7+
}
8+
?>
9+
--FILE--
10+
<?php
11+
12+
$xml = <<<XML
13+
<?xml version='1.0'?>
14+
<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
15+
<wddxPacket version="1.0">
16+
<var name="XXXX">
17+
<boolean value="1">
18+
<dateTime>1998-06-12T04:32:12+00</dateTime>
19+
</boolean>
20+
</var>
21+
</wddxPacket>
22+
XML;
23+
24+
$array = wddx_deserialize($xml);
25+
var_dump($array);
26+
?>
27+
--EXPECT--
28+
NULL

Diff for: ext/wddx/wddx.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -886,10 +886,10 @@ static void php_wddx_pop_element(void *user_data, const XML_Char *name)
886886
if (Z_TYPE(ent1->data) == IS_UNDEF) {
887887
if (stack->top > 1) {
888888
stack->top--;
889+
efree(ent1);
889890
} else {
890891
stack->done = 1;
891892
}
892-
efree(ent1);
893893
return;
894894
}
895895

0 commit comments

Comments
 (0)