Backported from 5.6.25 by Remi. From 82b95bb758ac707a2372f2edaed70589b6f374d3 Mon Sep 17 00:00:00 2001 From: Stanislav Malyshev Date: Sun, 7 Aug 2016 16:26:52 -0700 Subject: [PATCH] Fix bug #72750: wddx_deserialize null dereference --- ext/wddx/tests/bug72750.phpt | 34 ++++++++++++++++++++++++++++++++++ ext/wddx/wddx.c | 8 ++++++-- 2 files changed, 40 insertions(+), 2 deletions(-) create mode 100644 ext/wddx/tests/bug72750.phpt diff --git a/ext/wddx/tests/bug72750.phpt b/ext/wddx/tests/bug72750.phpt new file mode 100644 index 0000000..3a6794d --- /dev/null +++ b/ext/wddx/tests/bug72750.phpt @@ -0,0 +1,34 @@ +--TEST-- +Bug #72750: wddx_deserialize null dereference +--SKIPIF-- + +--FILE-- + + + +
+ + + + \\tYmluYXJRhdGE= + + + + +XML; + +$array = wddx_deserialize($xml); +var_dump($array); +?> +--EXPECT-- +array(1) { + ["aBinary"]=> + string(0) "" +} diff --git a/ext/wddx/wddx.c b/ext/wddx/wddx.c index faadbfe1..1b2d103 100644 --- a/ext/wddx/wddx.c +++ b/ext/wddx/wddx.c @@ -952,8 +952,12 @@ static void php_wddx_pop_element(void *user_data, const XML_Char *name) new_str = php_base64_decode(Z_STRVAL_P(ent1->data), Z_STRLEN_P(ent1->data), &new_len); STR_FREE(Z_STRVAL_P(ent1->data)); - Z_STRVAL_P(ent1->data) = new_str; - Z_STRLEN_P(ent1->data) = new_len; + if (new_str) { + Z_STRVAL_P(ent1->data) = new_str; + Z_STRLEN_P(ent1->data) = new_len; + } else { + ZVAL_EMPTY_STRING(ent1->data); + } } /* Call __wakeup() method on the object. */