Skip to content
Permalink
Browse files Browse the repository at this point in the history
Fix for bug #72790 and bug #72799
(cherry picked from commit a14fdb9)

Conflicts:
	ext/wddx/wddx.c
  • Loading branch information
smalyshev authored and weltling committed Aug 16, 2016
1 parent 67d0fe3 commit 0c8a2a2
Show file tree
Hide file tree
Showing 3 changed files with 64 additions and 1 deletion.
35 changes: 35 additions & 0 deletions ext/wddx/tests/bug72790.phpt
@@ -0,0 +1,35 @@
--TEST--
Bug 72790: wddx_deserialize null dereference with invalid xml
--SKIPIF--
<?php
if (!extension_loaded('wddx')) {
die('skip. wddx not available');
}
?>
--FILE--
<?php

$xml = <<< XML
<?xml version='1.0' ?>
<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
<wddxPacket version='1.0'>
|array>
<var name="XXXX">
<boolean value="this">
</boolean>
</var>
<var name="YYYY">
<var name="UUUU">
<var name="EZEZ">
</var>
</var>
</var>
</array>
</wddxPacket>
XML;

$array = wddx_deserialize($xml);
var_dump($array);
?>
--EXPECT--
NULL
28 changes: 28 additions & 0 deletions ext/wddx/tests/bug72799.phpt
@@ -0,0 +1,28 @@
--TEST--
Bug #72799: wddx_deserialize null dereference in php_wddx_pop_element
--SKIPIF--
<?php
if (!extension_loaded('wddx')) {
die('skip. wddx not available');
}
?>
--FILE--
<?php

$xml = <<<XML
<?xml version='1.0'?>
<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
<wddxPacket version="1.0">
<var name="XXXX">
<boolean value="1">
<dateTime>1998-06-12T04:32:12+00</dateTime>
</boolean>
</var>
</wddxPacket>
XML;

$array = wddx_deserialize($xml);
var_dump($array);
?>
--EXPECT--
NULL
2 changes: 1 addition & 1 deletion ext/wddx/wddx.c
Expand Up @@ -886,10 +886,10 @@ static void php_wddx_pop_element(void *user_data, const XML_Char *name)
if (Z_TYPE(ent1->data) == IS_UNDEF) {
if (stack->top > 1) {
stack->top--;
efree(ent1);
} else {
stack->done = 1;
}
efree(ent1);
return;
}

Expand Down

0 comments on commit 0c8a2a2

Please sign in to comment.