From: Nikita Popov <nikita.ppv@gmail.com>
Date: Sun, 25 Jun 2017 18:14:58 +0000 (+0200)
Subject: Fixed bug #73173
X-Git-Tag: php-7.0.22RC1~39
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=604827b694aaf1ffcbd986043ba27642534f2ccf;p=php

Fixed bug #73173

Patch by tloi at fortinet dot com.
---

diff --git a/NEWS b/NEWS
index f215ab8dd7..b790a26e9f 100644
--- a/NEWS
+++ b/NEWS
@@ -11,6 +11,10 @@ PHP                                                                        NEWS
 - SPL:
   . Fixed bug #73471 (PHP freezes with AppendIterator). (jhdxr)
 
+- Wddx:
+  . Fixed bug #73173 (huge memleak when wddx_unserialize).
+    (tloi at fortinet dot com)
+
 - zlib:
   . Fixed bug #73944 (dictionary option of inflate_init() does not work).
     (wapmorgan)
diff --git a/ext/wddx/tests/bug73173.phpt b/ext/wddx/tests/bug73173.phpt
new file mode 100644
index 0000000000..00fe56e4b0
--- /dev/null
+++ b/ext/wddx/tests/bug73173.phpt
@@ -0,0 +1,25 @@
+--TEST--
+Bug #73173: huge memleak when wddx_unserialize
+--SKIPIF--
+<?php if (!extension_loaded("wddx")) print "skip"; ?>
+--FILE--
+<?php
+
+$xml=<<<XML
+<?xml version='1.0'?>
+<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
+<wddxPacket>
+<var name="
+XML;
+
+$xml .= str_repeat('F',0x80000);
+
+$xml .= <<<XML
+">
+</wddxPacket>
+XML;
+var_dump(wddx_deserialize($xml));
+
+?>
+--EXPECT--
+NULL
diff --git a/ext/wddx/wddx.c b/ext/wddx/wddx.c
index 4040ed61c6..25d7deae17 100644
--- a/ext/wddx/wddx.c
+++ b/ext/wddx/wddx.c
@@ -241,6 +241,9 @@ static int wddx_stack_destroy(wddx_stack *stack)
 		}
 		efree(stack->elements);
 	}
+	if (stack->varname) {
+		efree(stack->varname);
+	}
 	return SUCCESS;
 }
 /* }}} */