blob: ce46d5ec7e60fa8073fd9ca1b2d654bd9a802688 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
|
--TEST--
Bug #71587 (Use-After-Free / Double-Free in WDDX Deserialize)
--SKIPIF--
<?php
if (!extension_loaded("wddx")) print "skip";
?>
--FILE--
<?php
$xml = <<<EOF
<?xml version='1.0' ?>
<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
<wddxPacket version='1.0'>
<array>
<var name='ML'></var>
<string>manhluat</string>
<var name='ML2'></var>
<boolean value='a'/>
<boolean value='true'/>
</array>
</wddxPacket>
EOF;
$wddx = wddx_deserialize($xml);
var_dump($wddx);
// Print mem leak
foreach($wddx as $k=>$v)
printf("Key: %s\nValue: %s\n",bin2hex($k),bin2hex($v));
?>
DONE
--EXPECT--
array(2) {
[0]=>
string(8) "manhluat"
[1]=>
bool(true)
}
Key: 30
Value: 6d616e686c756174
Key: 31
Value: 31
DONE
|
