Skip to content

Commit b88393f

Browse files
committed
Fix bug #72860: wddx_deserialize use-after-free
1 parent 65c8caa commit b88393f

File tree

2 files changed

+29
-1
lines changed

2 files changed

+29
-1
lines changed

Diff for: ext/wddx/tests/bug72860.phpt

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
--TEST--
2+
Bug #72860: wddx_deserialize use-after-free
3+
--SKIPIF--
4+
<?php
5+
if (!extension_loaded('wddx')) {
6+
die('skip. wddx not available');
7+
}
8+
?>
9+
--FILE--
10+
<?php
11+
12+
$xml=<<<XML
13+
<?xml version='1.0'?>
14+
<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
15+
<wddxPacket version='1.0'>
16+
<recordset fieldNames='F'>
17+
<field name='F'>
18+
</recordset>
19+
</wddxPacket>
20+
XML;
21+
22+
var_dump(wddx_deserialize($xml));
23+
?>
24+
DONE
25+
--EXPECT--
26+
NULL
27+
DONE

Diff for: ext/wddx/wddx.c

+2-1
Original file line numberDiff line numberDiff line change
@@ -230,7 +230,8 @@ static int wddx_stack_destroy(wddx_stack *stack)
230230

231231
if (stack->elements) {
232232
for (i = 0; i < stack->top; i++) {
233-
if (((st_entry *)stack->elements[i])->data) {
233+
if (((st_entry *)stack->elements[i])->data
234+
&& ((st_entry *)stack->elements[i])->type != ST_FIELD) {
234235
zval_ptr_dtor(&((st_entry *)stack->elements[i])->data);
235236
}
236237
if (((st_entry *)stack->elements[i])->varname) {

0 commit comments

Comments
 (0)