fix #38378 (wddx_serialize_value() generates no wellformed xml)

diff --git a/NEWS b/NEWS
index 46f334349bfe683d2120069de8cd1652d3c7cc52..68a3209c51180885171321a7ba83f046a69a2db4 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,8 @@
 PHP 4                                                                      NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2006, Version 4.4.5
+- Fixed bug #38378 (wddx_serialize_value() generates no wellformed xml). 
+  (sj at sjaensch dot org, grzegorz dot nosek at netart dot pl, Tony).
        
 17 Aug 2006, Version 4.4.4
 - Fixed memory_limit on 64bit systems. (Stefan E.)

diff --git a/ext/wddx/tests/bug38738.phpt b/ext/wddx/tests/bug38738.phpt
new file mode 100644 (file)
index 0000000..1a20e6d
--- /dev/null
+++ b/ext/wddx/tests/bug38738.phpt
@@ -0,0 +1,12 @@
+--TEST--
+Bug #38378 (wddx_serialize_vars() generates no wellformed xml)
+--FILE--
+<?php
+$hash = array();
+$hash["int"] = 1;
+$hash["string"] = "test";
+
+var_dump(wddx_serialize_vars('hash'));
+?>
+--EXPECT--
+string(204) "<wddxPacket version='1.0'><header/><data><struct><var name='hash'><struct><var name='int'><number>1</number></var><var name='string'><string>test</string></var></struct></var></struct></data></wddxPacket>"

diff --git a/ext/wddx/wddx.c b/ext/wddx/wddx.c
index 870298895ca39e9b3788bd4b65afc042d91b3a1c..ffca16bb39d03cbef3c490afb5d57c78329dddac 100644 (file)
--- a/ext/wddx/wddx.c
+++ b/ext/wddx/wddx.c
@@ -432,7 +432,7 @@ static void php_wddx_serialize_number(wddx_packet *packet, zval *var)
        tmp = *var;
        zval_copy_ctor(&tmp);
        convert_to_string(&tmp);
-       snprintf(tmp_buf, Z_STRLEN(tmp), WDDX_NUMBER, Z_STRVAL(tmp));
+       snprintf(tmp_buf, sizeof(tmp_buf), WDDX_NUMBER, Z_STRVAL(tmp));
        zval_dtor(&tmp);
 
        php_wddx_add_chunk(packet, tmp_buf);    
@@ -630,8 +630,8 @@ void php_wddx_serialize_var(wddx_packet *packet, zval *var, char *name, int name
 
        if (name) {
                name_esc = php_escape_html_entities(name, name_len, &name_esc_len, 0, ENT_QUOTES, NULL TSRMLS_CC);
-               tmp_buf = emalloc(name_esc_len + 1);
-               snprintf(tmp_buf, name_esc_len, WDDX_VAR_S, name_esc);
+               tmp_buf = emalloc(name_esc_len + sizeof(WDDX_VAR_S));
+               snprintf(tmp_buf, name_esc_len + sizeof(WDDX_VAR_S), WDDX_VAR_S, name_esc);
                php_wddx_add_chunk(packet, tmp_buf);
                efree(tmp_buf);
                efree(name_esc);