diff --git a/ext/wddx/tests/bug72790.phpt b/ext/wddx/tests/bug72790.phpt new file mode 100644 index 00000000000..a60524bdaf1 --- /dev/null +++ b/ext/wddx/tests/bug72790.phpt @@ -0,0 +1,35 @@ +--TEST-- +Bug 72790: wddx_deserialize null dereference with invalid xml +--SKIPIF-- + +--FILE-- + + + + |array> + + + + + + + + + + + + +XML; + +$array = wddx_deserialize($xml); +var_dump($array); +?> +--EXPECT-- +NULL \ No newline at end of file diff --git a/ext/wddx/tests/bug72799.phpt b/ext/wddx/tests/bug72799.phpt new file mode 100644 index 00000000000..5861d5538f4 --- /dev/null +++ b/ext/wddx/tests/bug72799.phpt @@ -0,0 +1,28 @@ +--TEST-- +Bug #72799: wddx_deserialize null dereference in php_wddx_pop_element +--SKIPIF-- + +--FILE-- + + + + + + 1998-06-12T04:32:12+00 + + + +XML; + +$array = wddx_deserialize($xml); +var_dump($array); +?> +--EXPECT-- +NULL \ No newline at end of file diff --git a/ext/wddx/wddx.c b/ext/wddx/wddx.c index d28cb7a0acb..11cf0be62e3 100644 --- a/ext/wddx/wddx.c +++ b/ext/wddx/wddx.c @@ -886,10 +886,10 @@ static void php_wddx_pop_element(void *user_data, const XML_Char *name) if (Z_TYPE(ent1->data) == IS_UNDEF) { if (stack->top > 1) { stack->top--; + efree(ent1); } else { stack->done = 1; } - efree(ent1); return; }