fix #34505 (possible memory corruption when unmangling properties with empty names)

2nd part

diff --git a/ext/soap/php_encoding.c b/ext/soap/php_encoding.c
index b53cf98937828c16e31331eae740292f632779ba..02ac85480d2ec145609293b0b02c9df80587ecae 100644 (file)
--- a/ext/soap/php_encoding.c
+++ b/ext/soap/php_encoding.c
@@ -1669,9 +1669,9 @@ static xmlNodePtr to_xml_object(encodeTypePtr type, zval *data, int style, xmlNo
                                zval **zprop;
                                char *str_key;
                                ulong index;
-                               int key_type;
+                               int key_type, str_key_len;
 
-                               key_type = zend_hash_get_current_key(prop, &str_key, &index, FALSE);
+                               key_type = zend_hash_get_current_key_ex(prop, &str_key, &str_key_len, &index, FALSE, NULL);
                                zend_hash_get_current_data(prop, (void **)&zprop);
 
                                property = master_to_xml(get_conversion((*zprop)->type), (*zprop), style, xmlParam);
@@ -1682,7 +1682,7 @@ static xmlNodePtr to_xml_object(encodeTypePtr type, zval *data, int style, xmlNo
                                        if (Z_TYPE_P(data) == IS_OBJECT) {
                                                char *class_name;
 
-                                               zend_unmangle_property_name(str_key, &class_name, &prop_name);
+                                               zend_unmangle_property_name_ex(str_key, str_key_len, &class_name, &prop_name);
                                        } else {
                                                prop_name = str_key;
                                        }

diff --git a/ext/standard/http.c b/ext/standard/http.c
index 2123bc22f4888eb6ca58d8a21d36cacce3b87be6..afa07f13d7c253e7ef43191929a9ef6802fc6915 100644 (file)
--- a/ext/standard/http.c
+++ b/ext/standard/http.c
@@ -69,7 +69,7 @@ PHPAPI int php_url_encode_hash_ex(HashTable *ht, smart_str *formstr,
                                /* private or protected property access outside of the class */
                                continue;
                        }
-                       zend_unmangle_property_name(key, &tmp, &key);
+                       zend_unmangle_property_name_ex(key, key_len, &tmp, &key);
                        key_len = strlen(key);          
                }
 

diff --git a/ext/standard/var.c b/ext/standard/var.c
index 78e444e9ea30ee6d59d126a01f9a78552f099015..a908fd7769363a2b78569f63d9045e20577c9304 100644 (file)
--- a/ext/standard/var.c
+++ b/ext/standard/var.c
@@ -76,7 +76,7 @@ static int php_object_property_dump(zval **zv, int num_args, va_list args, zend_
        if (hash_key->nKeyLength ==0 ) { /* numeric key */
                php_printf("%*c[%ld]=>\n", level + 1, ' ', hash_key->h);
        } else { /* string key */
-               zend_unmangle_property_name(hash_key->arKey, &class_name, &prop_name);
+               zend_unmangle_property_name_ex(hash_key->arKey, hash_key->nKeyLength, &class_name, &prop_name);
                if (class_name) {
                        php_printf("%*c[\"%s", level + 1, ' ', prop_name);
                        if (class_name[0]=='*') {
@@ -351,7 +351,7 @@ static int php_object_element_export(zval **zv, int num_args, va_list args, zend
 
        if (hash_key->nKeyLength != 0) {
                php_printf("%*c", level + 1, ' ');
-               zend_unmangle_property_name(hash_key->arKey, &class_name, &prop_name);
+               zend_unmangle_property_name_ex(hash_key->arKey, hash_key->nKeyLength, &class_name, &prop_name);
                if (class_name) {
                        if (class_name[0] == '*') {
                                php_printf("protected");

diff --git a/ext/wddx/wddx.c b/ext/wddx/wddx.c
index df516d771ef10434065fe980e19ec3d29643db24..3bd8bcf5969c2aba2eebcfcd9d371b4b10ccb892 100644 (file)
--- a/ext/wddx/wddx.c
+++ b/ext/wddx/wddx.c
@@ -524,7 +524,7 @@ static void php_wddx_serialize_object(wddx_packet *packet, zval *obj)
                        if (zend_hash_get_current_key_ex(HASH_OF(obj), &key, &key_len, &idx, 0, NULL) == HASH_KEY_IS_STRING) {
                                char *class_name, *prop_name;
                                
-                               zend_unmangle_property_name(key, &class_name, &prop_name);
+                               zend_unmangle_property_name_ex(key, key_len, &class_name, &prop_name);
                                php_wddx_serialize_var(packet, *ent, prop_name, strlen(prop_name)+1 TSRMLS_CC);
                        } else {
                                key_len = sprintf(tmp_buf, "%ld", idx);