Skip to content

Commit 2aae604

Browse files
committed
Fix bug #74145 - wddx parsing empty boolean tag leads to SIGSEGV
1 parent f8c514b commit 2aae604

File tree

3 files changed

+31
-9
lines changed

3 files changed

+31
-9
lines changed

ext/wddx/tests/bug74145.phpt

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
--TEST--
2+
Bug #74145 (wddx parsing empty boolean tag leads to SIGSEGV)
3+
--SKIPIF--
4+
<?php
5+
if (!extension_loaded("wddx")) print "skip";
6+
?>
7+
--FILE--
8+
<?php
9+
$data = file_get_contents(__DIR__ . '/bug74145.xml');
10+
$wddx = wddx_deserialize($data);
11+
var_dump($wddx);
12+
?>
13+
DONE
14+
--EXPECTF--
15+
NULL
16+
DONE

ext/wddx/tests/bug74145.xml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
<?xml version='1.0' ?>
2+
<!DOCTYPE et SYSTEM 'w'>
3+
<wddxPacket ven='1.0'>
4+
<array>
5+
<var Name="name">
6+
<boolean ></boolean>
7+
</var>
8+
</array>
9+
</wddxPacket>

ext/wddx/wddx.c

Lines changed: 6 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -799,22 +799,19 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
799799
} else if (!strcmp(name, EL_BOOLEAN)) {
800800
int i;
801801

802+
ALLOC_ZVAL(ent.data);
803+
INIT_PZVAL(ent.data);
804+
Z_TYPE_P(ent.data) = IS_BOOL;
805+
ent.type = ST_BOOLEAN;
806+
SET_STACK_VARNAME;
802807
if (atts) for (i = 0; atts[i]; i++) {
803808
if (!strcmp(atts[i], EL_VALUE) && atts[i+1] && atts[i+1][0]) {
804-
ent.type = ST_BOOLEAN;
805-
SET_STACK_VARNAME;
806-
807-
ALLOC_ZVAL(ent.data);
808-
INIT_PZVAL(ent.data);
809-
Z_TYPE_P(ent.data) = IS_BOOL;
810809
wddx_stack_push((wddx_stack *)stack, &ent, sizeof(st_entry));
811810
php_wddx_process_data(user_data, atts[i+1], strlen(atts[i+1]));
812811
break;
813812
}
814813
} else {
815-
ent.type = ST_BOOLEAN;
816-
SET_STACK_VARNAME;
817-
ZVAL_FALSE(&ent.data);
814+
ZVAL_FALSE(ent.data);
818815
wddx_stack_push((wddx_stack *)stack, &ent, sizeof(st_entry));
819816
}
820817
} else if (!strcmp(name, EL_NULL)) {

0 commit comments

Comments
 (0)