clones/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-09-22 10:27:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-7.0' into PHP-7.1

Browse Source 
* PHP-7.0:
  Fix bug #73631 - Invalid read when wddx decodes empty boolean element
This commit is contained in:
Stanislav Malyshev 2016-12-05 21:59:10 -08:00
commit 4ae4ca45aa
2 changed files with 24 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
ext/wddx/tests/bug73631.phpt Normal file
View File

@ -0,0 +1,19 @@
--TEST--
Bug #73631 (Memory leak due to invalid wddx stack processing)
--SKIPIF--
<?php if (!extension_loaded("wddx")) print "skip"; ?>
--FILE--
<?php
$xml = <<<EOF
<?xml version="1.0" ?>
<wddxPacket version="1.0">
<number>1234</number>
<binary><boolean/></binary>
</wddxPacket>
EOF;
$wddx = wddx_deserialize($xml);
var_dump($wddx);
?>
--EXPECTF--
int(1234)

5
ext/wddx/wddx.c
View File

@ -772,6 +772,11 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
php_wddx_process_data(user_data, atts[i+1], strlen((char *)atts[i+1]));
break;
}
} else {
ent.type = ST_BOOLEAN;
SET_STACK_VARNAME;
ZVAL_FALSE(&ent.data);
wddx_stack_push((wddx_stack *)stack, &ent, sizeof(st_entry));
}
} else if (!strcmp((char *)name, EL_NULL)) {
ent.type = ST_NULL;