diff options
| author | Stanislav Malyshev <stas@php.net> | 2016-09-05 23:42:31 -0700 |
|---|---|---|
| committer | Ferenc Kovacs <tyra3l@gmail.com> | 2016-09-15 10:03:27 +0200 |
| commit | 780daee62b55995a10f8e849159eff0a25bacb9d (patch) | |
| tree | 662c6cdda51a721af03eb72e8d6164c95b24020f | |
| parent | a777ec8df9d96fed9bb7e6b9b509678a90e656a6 (diff) | |
| download | php-git-780daee62b55995a10f8e849159eff0a25bacb9d.tar.gz | |
Fix bug #72860: wddx_deserialize use-after-free
| -rw-r--r-- | ext/wddx/tests/bug72860.phpt | 27 | ||||
| -rw-r--r-- | ext/wddx/wddx.c | 3 |
2 files changed, 29 insertions, 1 deletions
diff --git a/ext/wddx/tests/bug72860.phpt b/ext/wddx/tests/bug72860.phpt new file mode 100644 index 0000000000..6385457e8e --- /dev/null +++ b/ext/wddx/tests/bug72860.phpt @@ -0,0 +1,27 @@ +--TEST-- +Bug #72860: wddx_deserialize use-after-free +--SKIPIF-- +<?php +if (!extension_loaded('wddx')) { + die('skip. wddx not available'); +} +?> +--FILE-- +<?php + +$xml=<<<XML +<?xml version='1.0'?> +<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'> +<wddxPacket version='1.0'> + <recordset fieldNames='F'> + <field name='F'> + </recordset> +</wddxPacket> +XML; + +var_dump(wddx_deserialize($xml)); +?> +DONE +--EXPECT-- +NULL +DONE
\ No newline at end of file diff --git a/ext/wddx/wddx.c b/ext/wddx/wddx.c index d7bd295832..b02d2f07de 100644 --- a/ext/wddx/wddx.c +++ b/ext/wddx/wddx.c @@ -230,7 +230,8 @@ static int wddx_stack_destroy(wddx_stack *stack) if (stack->elements) { for (i = 0; i < stack->top; i++) { - if (((st_entry *)stack->elements[i])->data) { + if (((st_entry *)stack->elements[i])->data + && ((st_entry *)stack->elements[i])->type != ST_FIELD) { zval_ptr_dtor(&((st_entry *)stack->elements[i])->data); } if (((st_entry *)stack->elements[i])->varname) { |