- MFH Bugfix 37587

diff --git a/NEWS b/NEWS
index 07531340032dfb14716977f9148a558db110ce77..70b0f447bba53d75a20322ca8bb36f71e4089cbe 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -44,6 +44,7 @@ PHP                                                                        NEWS
 - Added implementation of curl_multi_info_read(). (Brian)
 - Added RFC2397 (data: stream) support. (Marcus)
 - Fixed handling of extremely long paths inside tempnam() function. (Ilia)
+- Fixed bug #37587 (var without attribute causes segfault). (Marcus)
 - Fixed bug #37565 (Using reflection::export with simplexml causing a crash).
   (Marcus)
 - Fixed bug #37563 (array_key_exists performance is poor for &$array). (Ilia)

diff --git a/ext/wddx/tests/bug37587.phpt b/ext/wddx/tests/bug37587.phpt
new file mode 100755 (executable)
index 0000000..81e4853
--- /dev/null
+++ b/ext/wddx/tests/bug37587.phpt
@@ -0,0 +1,41 @@
+--TEST--
+Bug #37587 (var without attribute causes segfault)
+--FILE--
+<?php
+
+var_dump(wddx_deserialize(file_get_contents(<<<EOF
+data:,<wddxPacket version='1.0'>
+<header/>
+<data>
+  <array length='1'>
+    <var>
+      <struct>
+        <var name='test'><string>Hello World</string></var>
+      </struct>
+    </var>
+  </array>
+</data>
+</wddxPacket>
+EOF
+)));
+
+?>
+===DONE===
+--EXPECT--
+array(1) {
+  [0]=>
+  array(1) {
+    ["test"]=>
+    string(11) "Hello World"
+  }
+}
+===DONE===
+--UEXPECT--
+array(1) {
+  [0]=>
+  array(1) {
+    [u"test"]=>
+    string(11) "Hello World"
+  }
+}
+===DONE===

diff --git a/ext/wddx/wddx.c b/ext/wddx/wddx.c
index b2833b2f1172d9217a973d50a939431d07f0f093..76b136a63bbaef14c1f54267f0918ca6c76712c2 100644 (file)
--- a/ext/wddx/wddx.c
+++ b/ext/wddx/wddx.c
@@ -723,7 +723,7 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
        if (!strcmp(name, EL_PACKET)) {
                int i;
                
-               for (i=0; atts[i]; i++) {
+               if (atts) for (i=0; atts[i]; i++) {
                        if (!strcmp(atts[i], EL_VERSION)) {
                                /* nothing for now */
                        }
@@ -751,7 +751,7 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
        } else if (!strcmp(name, EL_CHAR)) {
                int i;
                
-               for (i = 0; atts[i]; i++) {
+               if (atts) for (i = 0; atts[i]; i++) {
                        if (!strcmp(atts[i], EL_CHAR_CODE) && atts[++i] && atts[i][0]) {
                                char tmp_buf[2];
 
@@ -771,7 +771,7 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
        } else if (!strcmp(name, EL_BOOLEAN)) {
                int i;
 
-               for (i = 0; atts[i]; i++) {
+               if (atts) for (i = 0; atts[i]; i++) {
                        if (!strcmp(atts[i], EL_VALUE) && atts[++i] && atts[i][0]) {
                                ent.type = ST_BOOLEAN;
                                SET_STACK_VARNAME;
@@ -812,7 +812,7 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
        } else if (!strcmp(name, EL_VAR)) {
                int i;
                
-               for (i = 0; atts[i]; i++) {
+               if (atts) for (i = 0; atts[i]; i++) {
                        if (!strcmp(atts[i], EL_NAME) && atts[++i] && atts[i][0]) {
                                char *decoded;
                                int decoded_len;
@@ -829,7 +829,7 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
                MAKE_STD_ZVAL(ent.data);
                array_init(ent.data);
 
-               for (i = 0; atts[i]; i++) {
+               if (atts) for (i = 0; atts[i]; i++) {
                        if (!strcmp(atts[i], "fieldNames") && atts[++i] && atts[i][0]) {
                                zval *tmp;
                                char *key;
@@ -869,7 +869,7 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
                ent.varname = NULL;
                ent.data = NULL;
 
-               for (i = 0; atts[i]; i++) {
+               if (atts) for (i = 0; atts[i]; i++) {
                        if (!strcmp(atts[i], EL_NAME) && atts[++i] && atts[i][0]) {
                                char *decoded;
                                int decoded_len;