MFB5.1: fix #32179 (xmlrpc_encode() segfaults with recursive references)

php · Oct 4, 2005 · 6717af3 · 6717af3
1 parent 9b95efa
commit 6717af3
Show file tree

Hide file tree

Showing 2 changed files with 29 additions and 15 deletions.
diff --git a/NEWS b/NEWS
@@ -43,6 +43,7 @@ PHP 4                                                                      NEWS
 - Fixed bug #33156 (cygwin version of setitimer doesn't accept ITIMER_PROF).
   (Nuno)
 - Fixed bug #32589 (possible crash inside imap_mail_compose() function). (Ilia)
+- Fixed bug #32179 (xmlrpc_encode() segfaults with recursive references). (Tony)
 - Fixed bug #32160 (copying a file into itself leads to data loss). (Ilia)
 - Fixed bug #31158 (array_splice on $GLOBALS crashes). (Dmitry)
 - Fixed bug #29253 (array_diff with $GLOBALS argument fails). (Dmitry)

diff --git a/ext/xmlrpc/xmlrpc-epi-php.c b/ext/xmlrpc/xmlrpc-epi-php.c
@@ -524,28 +524,41 @@ static XMLRPC_VALUE PHP_to_XMLRPC_worker (const char* key, zval* in_val, int dep
                   unsigned long num_index;
                   zval** pIter;
                   char* my_key;
+                  HashTable *ht = NULL;
 
+                  ht = HASH_OF(val);
+                  if (ht && ht->nApplyCount > 1) {
+                      php_error_docref(NULL TSRMLS_CC, E_ERROR, "XML-RPC doesn't support circular references");
+                      return NULL;
+                  }
+
                   convert_to_array(val);
-
                   xReturn = XMLRPC_CreateVector(key, determine_vector_type(Z_ARRVAL_P(val)));
 
                   zend_hash_internal_pointer_reset(Z_ARRVAL_P(val));
-                  while(1) {
+                  while(zend_hash_get_current_data(Z_ARRVAL_P(val), (void**)&pIter) == SUCCESS) {
                      int res = my_zend_hash_get_current_key(Z_ARRVAL_P(val), &my_key, &num_index);
-                     if(res == HASH_KEY_IS_LONG) {
-                        if(zend_hash_get_current_data(Z_ARRVAL_P(val), (void**)&pIter) == SUCCESS) {
-                           XMLRPC_AddValueToVector(xReturn, PHP_to_XMLRPC_worker(0, *pIter, depth++));
-                        }
-                     }
-                     else if(res == HASH_KEY_NON_EXISTANT) {
-                        break;
+
+                     switch (res) {
+                         case HASH_KEY_NON_EXISTANT:
+                             break;
+                         case HASH_KEY_IS_STRING:
+                         case HASH_KEY_IS_LONG:
+                              ht = HASH_OF(*pIter);
+                             if (ht) {
+                                 ht->nApplyCount++;
+                             }
+                             if (res == HASH_KEY_IS_LONG) {
+                                 XMLRPC_AddValueToVector(xReturn, PHP_to_XMLRPC_worker(0, *pIter, depth++));
+                             }
+                             else {
+                                 XMLRPC_AddValueToVector(xReturn, PHP_to_XMLRPC_worker(my_key, *pIter, depth++));
+                             }
+                             if (ht) {
+                                 ht->nApplyCount--;
+                             }
+                             break;
                      }
-                     else if(res == HASH_KEY_IS_STRING) {
-                        if(zend_hash_get_current_data(Z_ARRVAL_P(val), (void**)&pIter) == SUCCESS) {
-                           XMLRPC_AddValueToVector(xReturn, PHP_to_XMLRPC_worker(my_key, *pIter, depth++));
-                        }
-                     }
-
                      zend_hash_move_forward(Z_ARRVAL_P(val));
                   }
                }