File tree 2 files changed +29
-1
lines changed
2 files changed +29
-1
lines changed Original file line number Diff line number Diff line change 1+ --TEST--
2+ Bug #72860: wddx_deserialize use-after-free
3+ --SKIPIF--
4+ <?php
5+ if (!extension_loaded ('wddx ' )) {
6+ die ('skip. wddx not available ' );
7+ }
8+ ?>
9+ --FILE--
10+ <?php
11+
12+ $ xml =<<<XML
13+ <?xml version='1.0'?>
14+ <!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
15+ <wddxPacket version='1.0'>
16+ <recordset fieldNames='F'>
17+ <field name='F'>
18+ </recordset>
19+ </wddxPacket>
20+ XML ;
21+
22+ var_dump (wddx_deserialize ($ xml ));
23+ ?>
24+ DONE
25+ --EXPECT--
26+ NULL
27+ DONE
Original file line number Diff line number Diff line change @@ -230,7 +230,8 @@ static int wddx_stack_destroy(wddx_stack *stack)
230230
231231 if (stack -> elements ) {
232232 for (i = 0 ; i < stack -> top ; i ++ ) {
233- if (((st_entry * )stack -> elements [i ])-> data ) {
233+ if (((st_entry * )stack -> elements [i ])-> data
234+ && ((st_entry * )stack -> elements [i ])-> type != ST_FIELD ) {
234235 zval_ptr_dtor (& ((st_entry * )stack -> elements [i ])-> data );
235236 }
236237 if (((st_entry * )stack -> elements [i ])-> varname ) {
You can’t perform that action at this time.
0 commit comments