- MFH Bugfix 37587

2 files changed, 47 insertions, 6 deletions

diff --git a/ext/wddx/tests/bug37587.phpt b/ext/wddx/tests/bug37587.phpt
new file mode 100755
index 0000000000..81e485325c
--- /dev/null
+++ b/ext/wddx/tests/bug37587.phpt
@@ -0,0 +1,41 @@
+--TEST--
+Bug #37587 (var without attribute causes segfault)
+--FILE--
+<?php
+
+var_dump(wddx_deserialize(file_get_contents(<<<EOF
+data:,<wddxPacket version='1.0'>
+<header/>
+<data>
+  <array length='1'>
+    <var>
+      <struct>
+        <var name='test'><string>Hello World</string></var>
+      </struct>
+    </var>
+  </array>
+</data>
+</wddxPacket>
+EOF
+)));
+
+?>
+===DONE===
+--EXPECT--
+array(1) {
+  [0]=>
+  array(1) {
+    ["test"]=>
+    string(11) "Hello World"
+  }
+}
+===DONE===
+--UEXPECT--
+array(1) {
+  [0]=>
+  array(1) {
+    [u"test"]=>
+    string(11) "Hello World"
+  }
+}
+===DONE===
diff --git a/ext/wddx/wddx.c b/ext/wddx/wddx.c
index b2833b2f11..76b136a63b 100644
--- a/ext/wddx/wddx.c
+++ b/ext/wddx/wddx.c
@@ -723,7 +723,7 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
 	if (!strcmp(name, EL_PACKET)) {
 		int i;
 		
-		for (i=0; atts[i]; i++) {
+		if (atts) for (i=0; atts[i]; i++) {
 			if (!strcmp(atts[i], EL_VERSION)) {
 				/* nothing for now */
 			}
@@ -751,7 +751,7 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
 	} else if (!strcmp(name, EL_CHAR)) {
 		int i;
 		
-		for (i = 0; atts[i]; i++) {
+		if (atts) for (i = 0; atts[i]; i++) {
 			if (!strcmp(atts[i], EL_CHAR_CODE) && atts[++i] && atts[i][0]) {
 				char tmp_buf[2];
 
@@ -771,7 +771,7 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
 	} else if (!strcmp(name, EL_BOOLEAN)) {
 		int i;
 
-		for (i = 0; atts[i]; i++) {
+		if (atts) for (i = 0; atts[i]; i++) {
 			if (!strcmp(atts[i], EL_VALUE) && atts[++i] && atts[i][0]) {
 				ent.type = ST_BOOLEAN;
 				SET_STACK_VARNAME;
@@ -812,7 +812,7 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
 	} else if (!strcmp(name, EL_VAR)) {
 		int i;
 		
-		for (i = 0; atts[i]; i++) {
+		if (atts) for (i = 0; atts[i]; i++) {
 			if (!strcmp(atts[i], EL_NAME) && atts[++i] && atts[i][0]) {
 				char *decoded;
 				int decoded_len;
@@ -829,7 +829,7 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
 		MAKE_STD_ZVAL(ent.data);
 		array_init(ent.data);
 
-		for (i = 0; atts[i]; i++) {
+		if (atts) for (i = 0; atts[i]; i++) {
 			if (!strcmp(atts[i], "fieldNames") && atts[++i] && atts[i][0]) {
 				zval *tmp;
 				char *key;
@@ -869,7 +869,7 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
 		ent.varname = NULL;
 		ent.data = NULL;
 
-		for (i = 0; atts[i]; i++) {
+		if (atts) for (i = 0; atts[i]; i++) {
 			if (!strcmp(atts[i], EL_NAME) && atts[++i] && atts[i][0]) {
 				char *decoded;
 				int decoded_len;