Fix bug #74145 - wddx parsing empty boolean tag leads to SIGSEGV

diff --git a/ext/wddx/tests/bug74145.phpt b/ext/wddx/tests/bug74145.phpt
new file mode 100644 (file)
index 0000000..a99a117
--- /dev/null
+++ b/ext/wddx/tests/bug74145.phpt
@@ -0,0 +1,16 @@
+--TEST--
+Bug #74145 (wddx parsing empty boolean tag leads to SIGSEGV)
+--SKIPIF--
+<?php
+if (!extension_loaded("wddx")) print "skip";
+?>
+--FILE--
+<?php
+$data = file_get_contents(__DIR__ . '/bug74145.xml');
+$wddx = wddx_deserialize($data);
+var_dump($wddx);
+?>
+DONE
+--EXPECTF--
+NULL
+DONE
\ No newline at end of file

diff --git a/ext/wddx/tests/bug74145.xml b/ext/wddx/tests/bug74145.xml
new file mode 100644 (file)
index 0000000..e5d35fb
--- /dev/null
+++ b/ext/wddx/tests/bug74145.xml
@@ -0,0 +1,9 @@
+<?xml version='1.0' ?>
+    <!DOCTYPE et SYSTEM 'w'>
+    <wddxPacket ven='1.0'>
+        <array>
+            <var Name="name">
+                <boolean \ 2></boolean>
+            </var>
+        </array>
+    </wddxPacket>

diff --git a/ext/wddx/wddx.c b/ext/wddx/wddx.c
index 72d2408c1f990f641a66f44c32977e86c06440c7..41fdd3d7954a94a4ff2353c96d81672d640223b4 100644 (file)
--- a/ext/wddx/wddx.c
+++ b/ext/wddx/wddx.c
@@ -799,22 +799,19 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
        } else if (!strcmp(name, EL_BOOLEAN)) {
                int i;
 
+               ALLOC_ZVAL(ent.data);
+               INIT_PZVAL(ent.data);
+               Z_TYPE_P(ent.data) = IS_BOOL;
+               ent.type = ST_BOOLEAN;
+               SET_STACK_VARNAME;
                if (atts) for (i = 0; atts[i]; i++) {
                        if (!strcmp(atts[i], EL_VALUE) && atts[i+1] && atts[i+1][0]) {
-                               ent.type = ST_BOOLEAN;
-                               SET_STACK_VARNAME;
-
-                               ALLOC_ZVAL(ent.data);
-                               INIT_PZVAL(ent.data);
-                               Z_TYPE_P(ent.data) = IS_BOOL;
                                wddx_stack_push((wddx_stack *)stack, &ent, sizeof(st_entry));
                                php_wddx_process_data(user_data, atts[i+1], strlen(atts[i+1]));
                                break;
                        }
                } else {
-                       ent.type = ST_BOOLEAN;
-                       SET_STACK_VARNAME;
-                       ZVAL_FALSE(&ent.data);
+                       ZVAL_FALSE(ent.data);
                        wddx_stack_push((wddx_stack *)stack, &ent, sizeof(st_entry));
                }
        } else if (!strcmp(name, EL_NULL)) {