Skip to content

Commit 698a691

Browse files
committed
Fix bug #72750: wddx_deserialize null dereference
1 parent e018ff0 commit 698a691

File tree

2 files changed

+38
-0
lines changed

2 files changed

+38
-0
lines changed

Diff for: ext/wddx/tests/bug72750.phpt

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
--TEST--
2+
Bug #72750: wddx_deserialize null dereference
3+
--SKIPIF--
4+
<?php
5+
if (!extension_loaded('wddx')) {
6+
die('skip. wddx not available');
7+
}
8+
?>
9+
--FILE--
10+
<?php
11+
12+
$xml = <<< XML
13+
<?xml version='1.0'?>
14+
<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
15+
<wddxPacket version='1.0'>
16+
<header/>
17+
<data>
18+
<struct>
19+
<var name='aBinary'>
20+
<binary length='11'>\\tYmluYXJRhdGE=</binary>
21+
</var>
22+
</struct>
23+
</data>
24+
</wddxPacket>
25+
XML;
26+
27+
$array = wddx_deserialize($xml);
28+
var_dump($array);
29+
?>
30+
--EXPECT--
31+
array(1) {
32+
["aBinary"]=>
33+
string(0) ""
34+
}

Diff for: ext/wddx/wddx.c

+4
Original file line numberDiff line numberDiff line change
@@ -959,8 +959,12 @@ static void php_wddx_pop_element(void *user_data, const XML_Char *name)
959959

960960
new_str = php_base64_decode(Z_STRVAL_P(ent1->data), Z_STRLEN_P(ent1->data), &new_len);
961961
STR_FREE(Z_STRVAL_P(ent1->data));
962+
if (new_str) {
962963
Z_STRVAL_P(ent1->data) = new_str;
963964
Z_STRLEN_P(ent1->data) = new_len;
965+
} else {
966+
ZVAL_EMPTY_STRING(ent1->data);
967+
}
964968
}
965969

966970
/* Call __wakeup() method on the object. */

0 commit comments

Comments
 (0)