MFH: fix #38431 (xmlrpc_get_type() crashes PHP on objects)

diff --git a/NEWS b/NEWS
index e68da52b8e786be987ea73aadf2f11ed2199fd54..14da84c02dd66bf0976fdff951c66b67fc722c1b 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -7,6 +7,7 @@ PHP 4                                                                      NEWS
   enabled. (Stefan E.)
 - Fixed a memory corruption error with an invalid foreach() call. (Stefan E.,
   Dmitry, Derick)
+- Fixed bug #38431 (xmlrpc_get_type() crashes PHP on objects). (Tony)
 - Fixed bug #38377 (session_destroy() gives warning after
   session_regenerate_id()). (Ilia)
 - Fixed bug #38322 (reading past array in sscanf() leads to arbitary code 

diff --git a/ext/xmlrpc/tests/bug38431.phpt b/ext/xmlrpc/tests/bug38431.phpt
new file mode 100644 (file)
index 0000000..288fe10
--- /dev/null
+++ b/ext/xmlrpc/tests/bug38431.phpt
@@ -0,0 +1,25 @@
+--TEST--
+Bug #38431 (xmlrpc_get_type() crashes PHP on objects)
+--SKIPIF--
+<?php if (!extension_loaded("xmlrpc")) print "skip"; ?>
+--FILE--
+<?php
+
+var_dump(xmlrpc_get_type(new stdclass));
+var_dump(xmlrpc_get_type(array()));
+$var = array(1,2,3);
+var_dump(xmlrpc_get_type($var));
+$var = array("test"=>1,2,3);
+var_dump(xmlrpc_get_type($var));
+$var = array("test"=>1,"test2"=>2);
+var_dump(xmlrpc_get_type($var));
+
+echo "Done\n";
+?>
+--EXPECTF--    
+string(5) "array"
+string(5) "array"
+string(5) "array"
+string(5) "mixed"
+string(6) "struct"
+Done

diff --git a/ext/xmlrpc/xmlrpc-epi-php.c b/ext/xmlrpc/xmlrpc-epi-php.c
index 5ab5e9ec578e65ec2412df8be4a4e878af7ed5b4..f38063b4be77fc8a98ec7219ecf48b0b224a35f8 100644 (file)
--- a/ext/xmlrpc/xmlrpc-epi-php.c
+++ b/ext/xmlrpc/xmlrpc-epi-php.c
@@ -1492,7 +1492,7 @@ PHP_FUNCTION(xmlrpc_get_type)
 
    type = get_zval_xmlrpc_type(arg, 0);
    if (type == xmlrpc_vector) {
-      vtype = determine_vector_type(Z_ARRVAL_P(arg));
+      vtype = determine_vector_type((Z_TYPE_P(arg) == IS_OBJECT) ? Z_OBJPROP_P(arg) : Z_ARRVAL_P(arg));
    }
    
    RETURN_STRING((char*) xmlrpc_type_as_str(type, vtype), 1);