php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-28 18:22:42 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix for bug #72790 and bug #72799

Browse Source 
(cherry picked from commit a14fdb9746262549bbbb96abb87338bacd147e1b)

Conflicts:
	ext/wddx/wddx.c
This commit is contained in:
Stanislav Malyshev
2016-08-10 23:43:56 -07:00
committed by Anatol Belski
parent 67d0fe39ee
commit 0c8a2a2cd1
3 changed files with 64 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
ext/wddx/tests/bug72790.phpt Normal file
View File

@@ -0,0 +1,35 @@
--TEST--
Bug 72790: wddx_deserialize null dereference with invalid xml
--SKIPIF--
<?php
if (!extension_loaded('wddx')) {
die('skip. wddx not available');
}
?>
--FILE--
<?php
$xml = <<< XML
<?xml version='1.0' ?>
<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
<wddxPacket version='1.0'>
|array>
<var name="XXXX">
<boolean value="this">
</boolean>
</var>
<var name="YYYY">
<var name="UUUU">
<var name="EZEZ">
</var>
</var>
</var>
</array>
</wddxPacket>
XML;
$array = wddx_deserialize($xml);
var_dump($array);
?>
--EXPECT--
NULL

28
ext/wddx/tests/bug72799.phpt Normal file
View File

@@ -0,0 +1,28 @@
--TEST--
Bug #72799: wddx_deserialize null dereference in php_wddx_pop_element
--SKIPIF--
<?php
if (!extension_loaded('wddx')) {
die('skip. wddx not available');
}
?>
--FILE--
<?php
$xml = <<<XML
<?xml version='1.0'?>
<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
<wddxPacket version="1.0">
<var name="XXXX">
<boolean value="1">
<dateTime>1998-06-12T04:32:12+00</dateTime>
</boolean>
</var>
</wddxPacket>
XML;
$array = wddx_deserialize($xml);
var_dump($array);
?>
--EXPECT--
NULL

2
ext/wddx/wddx.c
View File

@@ -886,10 +886,10 @@ static void php_wddx_pop_element(void *user_data, const XML_Char *name)
if (Z_TYPE(ent1->data) == IS_UNDEF) {
if (stack->top > 1) {
stack->top--;
efree(ent1);
} else {
stack->done = 1;
}
efree(ent1);
return;
}