diff options
| author | Stanislav Malyshev <stas@php.net> | 2016-01-13 16:43:04 -0800 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2016-01-13 16:43:04 -0800 |
| commit | 285cd3417fb61597345b829f5f573707bbdcd484 (patch) | |
| tree | 821051cce4bb6d36437af9ddf94c6e22e76f16a6 | |
| parent | 635ba1f2c3555d1c5c9a974b581083fd199dbc80 (diff) | |
| download | php-git-285cd3417fb61597345b829f5f573707bbdcd484.tar.gz | |
Fix bug #71335: Type Confusion in WDDX Packet Deserialization
| -rw-r--r-- | ext/wddx/tests/bug71335.phpt | 33 | ||||
| -rw-r--r-- | ext/wddx/wddx.c | 3 |
2 files changed, 35 insertions, 1 deletions
diff --git a/ext/wddx/tests/bug71335.phpt b/ext/wddx/tests/bug71335.phpt new file mode 100644 index 0000000000..57a7f14f81 --- /dev/null +++ b/ext/wddx/tests/bug71335.phpt @@ -0,0 +1,33 @@ +--TEST-- +Bug #71335 (Type Confusion in WDDX Packet Deserialization) +--SKIPIF-- +<?php +if (!extension_loaded("wddx")) print "skip"; +?> +--FILE-- +<?php +$x = "<?xml version='1.0'?> +<wddxPacket version='1.0'> +<header/> + <data> + <struct> + <var name='php_class_name'> + <string>stdClass</string> + </var> + <var name='php_class_name'> + <string>stdClass</string> + </var> + </struct> + </data> +</wddxPacket>"; + +$d = wddx_deserialize($x); +var_dump($d); +?> +DONE +--EXPECTF-- +object(stdClass)#%d (1) { + ["php_class_name"]=> + string(8) "stdClass" +} +DONE diff --git a/ext/wddx/wddx.c b/ext/wddx/wddx.c index b9dd1fa78e..7267ee1e94 100644 --- a/ext/wddx/wddx.c +++ b/ext/wddx/wddx.c @@ -978,7 +978,8 @@ static void php_wddx_pop_element(void *user_data, const XML_Char *name) if (ent1->varname) { if (!strcmp(ent1->varname, PHP_CLASS_NAME_VAR) && - Z_TYPE_P(ent1->data) == IS_STRING && Z_STRLEN_P(ent1->data) && ent2->type == ST_STRUCT) { + Z_TYPE_P(ent1->data) == IS_STRING && Z_STRLEN_P(ent1->data) && + ent2->type == ST_STRUCT && Z_TYPE_P(ent2->data) == IS_ARRAY) { zend_bool incomplete_class = 0; zend_str_tolower(Z_STRVAL_P(ent1->data), Z_STRLEN_P(ent1->data)); |