clones/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-09-22 02:17:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix #32179 (xmlrpc_encode() segfaults with recursive references)

Browse Source
This commit is contained in:
Antony Dovgal 2005-10-04 11:18:02 +00:00
parent 0a50368580
commit 3d8dc4d3b1
2 changed files with 29 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
NEWS
View File

@ -144,6 +144,7 @@ PHP NEWS
seg fault). (Dmitry)
- Fixed bug #32937 (open_basedir looses trailing / in the limiter). (Adam Conrad)
- Fixed bug #32589 (possible crash inside imap_mail_compose() function). (Ilia)
- Fixed bug #32179 (xmlrpc_encode() segfaults with recursive references). (Tony)
- Fixed bug #32139 (SOAP client does not auto-handle base64 encoding). (Ilia)
- Fixed bug #32010 (Memory leak in mssql_fetch_batch). (fmk)
- Fixed bug #29334 (win32 mail() provides incorrect Date: header). (Jani)

43
ext/xmlrpc/xmlrpc-epi-php.c
View File

@ -520,28 +520,41 @@ static XMLRPC_VALUE PHP_to_XMLRPC_worker (const char* key, zval* in_val, int dep
unsigned long num_index;
zval** pIter;
char* my_key;
HashTable *ht = NULL;
ht = HASH_OF(val);
if (ht && ht->nApplyCount > 1) {
php_error_docref(NULL TSRMLS_CC, E_ERROR, "XML-RPC doesn't support circular references");
return NULL;
}
convert_to_array(val);
xReturn = XMLRPC_CreateVector(key, determine_vector_type(Z_ARRVAL_P(val)));
zend_hash_internal_pointer_reset(Z_ARRVAL_P(val));
while(1) {
while(zend_hash_get_current_data(Z_ARRVAL_P(val), (void**)&pIter) == SUCCESS) {
int res = my_zend_hash_get_current_key(Z_ARRVAL_P(val), &my_key, &num_index);
if(res == HASH_KEY_IS_LONG) {
if(zend_hash_get_current_data(Z_ARRVAL_P(val), (void**)&pIter) == SUCCESS) {
XMLRPC_AddValueToVector(xReturn, PHP_to_XMLRPC_worker(0, *pIter, depth++));
}
switch (res) {
case HASH_KEY_NON_EXISTANT:
break;
case HASH_KEY_IS_STRING:
case HASH_KEY_IS_LONG:
ht = HASH_OF(*pIter);
if (ht) {
ht->nApplyCount++;
}
if (res == HASH_KEY_IS_LONG) {
XMLRPC_AddValueToVector(xReturn, PHP_to_XMLRPC_worker(0, *pIter, depth++));
}
else {
XMLRPC_AddValueToVector(xReturn, PHP_to_XMLRPC_worker(my_key, *pIter, depth++));
}
if (ht) {
ht->nApplyCount--;
}
break;
}
else if(res == HASH_KEY_NON_EXISTANT) {
break;
}
else if(res == HASH_KEY_IS_STRING) {
if(zend_hash_get_current_data(Z_ARRVAL_P(val), (void**)&pIter) == SUCCESS) {
XMLRPC_AddValueToVector(xReturn, PHP_to_XMLRPC_worker(my_key, *pIter, depth++));
}
}
zend_hash_move_forward(Z_ARRVAL_P(val));
}
}