summaryrefslogtreecommitdiffstats
path: root/bug72860.patch
diff options
context:
space:
mode:
authorRemi Collet <fedora@famillecollet.com>2016-09-19 14:11:20 +0200
committerRemi Collet <fedora@famillecollet.com>2016-09-19 14:11:20 +0200
commit661f662d2fe7ae74585367e5757bb04fbdea717b (patch)
tree6a2d3439a795711014d7d23761d36ea4296611eb /bug72860.patch
parenta2713f204e1202b6844c114a005c304aafb008c7 (diff)
PHP 5.5.38 with backports from 5.6.26
Diffstat (limited to 'bug72860.patch')
-rw-r--r--bug72860.patch62
1 files changed, 62 insertions, 0 deletions
diff --git a/bug72860.patch b/bug72860.patch
new file mode 100644
index 0000000..e26cae0
--- /dev/null
+++ b/bug72860.patch
@@ -0,0 +1,62 @@
+Backported from 5.6.26 by Remi.
+
+
+From 780daee62b55995a10f8e849159eff0a25bacb9d Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas@php.net>
+Date: Mon, 5 Sep 2016 23:42:31 -0700
+Subject: [PATCH] Fix bug #72860: wddx_deserialize use-after-free
+
+---
+ ext/wddx/tests/bug72860.phpt | 27 +++++++++++++++++++++++++++
+ ext/wddx/wddx.c | 3 ++-
+ 2 files changed, 29 insertions(+), 1 deletion(-)
+ create mode 100644 ext/wddx/tests/bug72860.phpt
+
+diff --git a/ext/wddx/tests/bug72860.phpt b/ext/wddx/tests/bug72860.phpt
+new file mode 100644
+index 0000000..6385457
+--- /dev/null
++++ b/ext/wddx/tests/bug72860.phpt
+@@ -0,0 +1,27 @@
++--TEST--
++Bug #72860: wddx_deserialize use-after-free
++--SKIPIF--
++<?php
++if (!extension_loaded('wddx')) {
++ die('skip. wddx not available');
++}
++?>
++--FILE--
++<?php
++
++$xml=<<<XML
++<?xml version='1.0'?>
++<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
++<wddxPacket version='1.0'>
++ <recordset fieldNames='F'>
++ <field name='F'>
++ </recordset>
++</wddxPacket>
++XML;
++
++var_dump(wddx_deserialize($xml));
++?>
++DONE
++--EXPECT--
++NULL
++DONE
+\ No newline at end of file
+diff --git a/ext/wddx/wddx.c b/ext/wddx/wddx.c
+index d7bd295..b02d2f0 100644
+--- a/ext/wddx/wddx.c
++++ b/ext/wddx/wddx.c
+@@ -232,7 +232,8 @@ static int wddx_stack_destroy(wddx_stack *stack)
+
+ if (stack->elements) {
+ for (i = 0; i < stack->top; i++) {
+- if (((st_entry *)stack->elements[i])->data) {
++ if (((st_entry *)stack->elements[i])->data
++ && ((st_entry *)stack->elements[i])->type != ST_FIELD) {
+ zval_ptr_dtor(&((st_entry *)stack->elements[i])->data);
+ }
+ if (((st_entry *)stack->elements[i])->varname) {