]> granicus.if.org Git - php/commitdiff
Merge branch 'PHP-5.6' into PHP-7.0
authorStanislav Malyshev <stas@php.net>
Tue, 6 Dec 2016 05:58:55 +0000 (21:58 -0800)
committerStanislav Malyshev <stas@php.net>
Tue, 6 Dec 2016 05:58:55 +0000 (21:58 -0800)
* PHP-5.6:
  Fix bug #73631 - Invalid read when wddx decodes empty boolean element

1  2 
ext/wddx/wddx.c

diff --cc ext/wddx/wddx.c
index b188e8929eff3b860c23075a0086135a29323dc9,0cee16b9ad0778833a596be4e170b5c3c2983639..662b95736937ff5dee23e280723b7fd9adf68212
@@@ -767,13 -804,20 +767,18 @@@ static void php_wddx_push_element(void 
                                ent.type = ST_BOOLEAN;
                                SET_STACK_VARNAME;
  
 -                              ALLOC_ZVAL(ent.data);
 -                              INIT_PZVAL(ent.data);
 -                              Z_TYPE_P(ent.data) = IS_BOOL;
 +                              ZVAL_TRUE(&ent.data);
                                wddx_stack_push((wddx_stack *)stack, &ent, sizeof(st_entry));
 -                              php_wddx_process_data(user_data, atts[i+1], strlen(atts[i+1]));
 +                              php_wddx_process_data(user_data, atts[i+1], strlen((char *)atts[i+1]));
                                break;
                        }
+               } else {
+                       ent.type = ST_BOOLEAN;
+                       SET_STACK_VARNAME;
+                       ZVAL_FALSE(&ent.data);
+                       wddx_stack_push((wddx_stack *)stack, &ent, sizeof(st_entry));
                }
 -      } else if (!strcmp(name, EL_NULL)) {
 +      } else if (!strcmp((char *)name, EL_NULL)) {
                ent.type = ST_NULL;
                SET_STACK_VARNAME;