From: Antony Dovgal <tony2001@php.net>
Date: Fri, 11 Aug 2006 17:43:04 +0000 (+0000)
Subject: MFH: fix #38431 (xmlrpc_get_type() crashes PHP on objects)
X-Git-Tag: php-5.2.0RC2~47
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=2eef59dc5940fa3ddd179adc579deba5167b0462;p=php

MFH: fix #38431 (xmlrpc_get_type() crashes PHP on objects)
---

diff --git a/NEWS b/NEWS
index 9fe70358a1..37ff4420e0 100644
--- a/NEWS
+++ b/NEWS
@@ -37,6 +37,7 @@ PHP                                                                        NEWS
 - Fixed phpinfo() cutoff of variables at \0. (Ilia)
 - Fixed a bug in the filter extension that prevented magic_quotes_gpc from
   being applied when RAW filter is used. (Ilia)
+- Fixed bug #38431 (xmlrpc_get_type() crashes PHP on objects). (Tony)
 - Fixed bug #38394 (PDO fails to recover from failed prepared statement
   execution). (Ilia)
 - Fixed bug #38377 (session_destroy() gives warning after
diff --git a/ext/xmlrpc/tests/bug38431.phpt b/ext/xmlrpc/tests/bug38431.phpt
new file mode 100644
index 0000000000..288fe1041d
--- /dev/null
+++ b/ext/xmlrpc/tests/bug38431.phpt
@@ -0,0 +1,25 @@
+--TEST--
+Bug #38431 (xmlrpc_get_type() crashes PHP on objects)
+--SKIPIF--
+<?php if (!extension_loaded("xmlrpc")) print "skip"; ?>
+--FILE--
+<?php
+
+var_dump(xmlrpc_get_type(new stdclass));
+var_dump(xmlrpc_get_type(array()));
+$var = array(1,2,3);
+var_dump(xmlrpc_get_type($var));
+$var = array("test"=>1,2,3);
+var_dump(xmlrpc_get_type($var));
+$var = array("test"=>1,"test2"=>2);
+var_dump(xmlrpc_get_type($var));
+
+echo "Done\n";
+?>
+--EXPECTF--	
+string(5) "array"
+string(5) "array"
+string(5) "array"
+string(5) "mixed"
+string(6) "struct"
+Done
diff --git a/ext/xmlrpc/xmlrpc-epi-php.c b/ext/xmlrpc/xmlrpc-epi-php.c
index 8b6f963f5d..69fe7534e9 100644
--- a/ext/xmlrpc/xmlrpc-epi-php.c
+++ b/ext/xmlrpc/xmlrpc-epi-php.c
@@ -1468,7 +1468,7 @@ PHP_FUNCTION(xmlrpc_get_type)
 
 	type = get_zval_xmlrpc_type(*arg, 0);
 	if (type == xmlrpc_vector) {
-		vtype = determine_vector_type(Z_ARRVAL_PP(arg));
+		vtype = determine_vector_type((Z_TYPE_PP(arg) == IS_OBJECT) ? Z_OBJPROP_PP(arg) : Z_ARRVAL_PP(arg));
 	}
    
 	RETURN_STRING((char*) xmlrpc_type_as_str(type, vtype), 1);