blob: 5af5a9b7c083bf1dcf5615d114eff2be602a124a (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
|
Backported from 5.6.25 by Remi.
From 82b95bb758ac707a2372f2edaed70589b6f374d3 Mon Sep 17 00:00:00 2001
From: Stanislav Malyshev <stas@php.net>
Date: Sun, 7 Aug 2016 16:26:52 -0700
Subject: [PATCH] Fix bug #72750: wddx_deserialize null dereference
---
ext/wddx/tests/bug72750.phpt | 34 ++++++++++++++++++++++++++++++++++
ext/wddx/wddx.c | 8 ++++++--
2 files changed, 40 insertions(+), 2 deletions(-)
create mode 100644 ext/wddx/tests/bug72750.phpt
diff --git a/ext/wddx/tests/bug72750.phpt b/ext/wddx/tests/bug72750.phpt
new file mode 100644
index 0000000..3a6794d
--- /dev/null
+++ b/ext/wddx/tests/bug72750.phpt
@@ -0,0 +1,34 @@
+--TEST--
+Bug #72750: wddx_deserialize null dereference
+--SKIPIF--
+<?php
+if (!extension_loaded('wddx')) {
+ die('skip. wddx not available');
+}
+?>
+--FILE--
+<?php
+
+$xml = <<< XML
+<?xml version='1.0'?>
+<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
+<wddxPacket version='1.0'>
+<header/>
+ <data>
+ <struct>
+ <var name='aBinary'>
+ <binary length='11'>\\tYmluYXJRhdGE=</binary>
+ </var>
+ </struct>
+ </data>
+</wddxPacket>
+XML;
+
+$array = wddx_deserialize($xml);
+var_dump($array);
+?>
+--EXPECT--
+array(1) {
+ ["aBinary"]=>
+ string(0) ""
+}
diff --git a/ext/wddx/wddx.c b/ext/wddx/wddx.c
index faadbfe1..1b2d103 100644
--- a/ext/wddx/wddx.c
+++ b/ext/wddx/wddx.c
@@ -952,8 +952,12 @@ static void php_wddx_pop_element(void *user_data, const XML_Char *name)
new_str = php_base64_decode(Z_STRVAL_P(ent1->data), Z_STRLEN_P(ent1->data), &new_len);
STR_FREE(Z_STRVAL_P(ent1->data));
- Z_STRVAL_P(ent1->data) = new_str;
- Z_STRLEN_P(ent1->data) = new_len;
+ if (new_str) {
+ Z_STRVAL_P(ent1->data) = new_str;
+ Z_STRLEN_P(ent1->data) = new_len;
+ } else {
+ ZVAL_EMPTY_STRING(ent1->data);
+ }
}
/* Call __wakeup() method on the object. */
|
