- Bugfix 37587

2 files changed, 46 insertions, 5 deletions

diff --git a/ext/wddx/tests/bug37587.phpt b/ext/wddx/tests/bug37587.phpt
new file mode 100755
index 0000000000..81e485325c
--- /dev/null
+++ b/ext/wddx/tests/bug37587.phpt
@@ -0,0 +1,41 @@
+--TEST--
+Bug #37587 (var without attribute causes segfault)
+--FILE--
+<?php
+
+var_dump(wddx_deserialize(file_get_contents(<<<EOF
+data:,<wddxPacket version='1.0'>
+<header/>
+<data>
+  <array length='1'>
+    <var>
+      <struct>
+        <var name='test'><string>Hello World</string></var>
+      </struct>
+    </var>
+  </array>
+</data>
+</wddxPacket>
+EOF
+)));
+
+?>
+===DONE===
+--EXPECT--
+array(1) {
+  [0]=>
+  array(1) {
+    ["test"]=>
+    string(11) "Hello World"
+  }
+}
+===DONE===
+--UEXPECT--
+array(1) {
+  [0]=>
+  array(1) {
+    [u"test"]=>
+    string(11) "Hello World"
+  }
+}
+===DONE===
diff --git a/ext/wddx/wddx.c b/ext/wddx/wddx.c
index b7362c4f30..3562c6e9f8 100644
--- a/ext/wddx/wddx.c
+++ b/ext/wddx/wddx.c
@@ -752,7 +752,7 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
 	} else if (!strcmp(name, EL_CHAR)) {
 		int i;
 		
-		for (i = 0; atts[i]; i++) {
+		if (atts) for (i = 0; atts[i]; i++) {
 			if (!strcmp(atts[i], EL_CHAR_CODE) && atts[++i] && atts[i][0]) {
 				char tmp_buf[2];
 
@@ -772,7 +772,7 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
 	} else if (!strcmp(name, EL_BOOLEAN)) {
 		int i;
 
-		for (i = 0; atts[i]; i++) {
+		if (atts) for (i = 0; atts[i]; i++) {
 			if (!strcmp(atts[i], EL_VALUE) && atts[++i] && atts[i][0]) {
 				ent.type = ST_BOOLEAN;
 				SET_STACK_VARNAME;
@@ -813,7 +813,7 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
 	} else if (!strcmp(name, EL_VAR)) {
 		int i;
 		
-		for (i = 0; atts[i]; i++) {
+		if (atts) for (i = 0; atts[i]; i++) {
 			if (!strcmp(atts[i], EL_NAME) && atts[++i] && atts[i][0]) {
 				char *decoded;
 				int decoded_len;
@@ -830,7 +830,7 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
 		MAKE_STD_ZVAL(ent.data);
 		array_init(ent.data);
 
-		for (i = 0; atts[i]; i++) {
+		if (atts) for (i = 0; atts[i]; i++) {
 			if (!strcmp(atts[i], "fieldNames") && atts[++i] && atts[i][0]) {
 				zval *tmp;
 				char *key;
@@ -870,7 +870,7 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
 		ent.varname = NULL;
 		ent.data = NULL;
 
-		for (i = 0; atts[i]; i++) {
+		if (atts) for (i = 0; atts[i]; i++) {
 			if (!strcmp(atts[i], EL_NAME) && atts[++i] && atts[i][0]) {
 				char *decoded;
 				int decoded_len;