From: Rob Richards <rrichards@php.net>
Date: Thu, 11 Sep 2008 14:18:27 +0000 (+0000)
Subject: MFH: fix bug #45901 (wddx_serialize_value crash with SimpleXMLElement object)
X-Git-Tag: php-5.2.7RC1~51
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=88bce658afb6e62074a70dc2873778b7a36407c0;p=php

MFH: fix bug #45901 (wddx_serialize_value crash with SimpleXMLElement object)
add test
---

diff --git a/ext/wddx/tests/bug45901.phpt b/ext/wddx/tests/bug45901.phpt
new file mode 100644
index 0000000000..4084ccbf20
--- /dev/null
+++ b/ext/wddx/tests/bug45901.phpt
@@ -0,0 +1,18 @@
+--TEST--
+Bug #45901 (wddx_serialize_value crash with SimpleXMLElement object)
+--SKIPIF--
+<?php
+if (!extension_loaded("wddx")) print "skip";
+if (!extension_loaded("simplexml")) print "skip SimpleXML not present";
+?>
+--FILE--
+<?php
+
+$xml = new SimpleXMLElement('<data></data>');
+$xml->addChild('test');
+echo wddx_serialize_value($xml, 'Variables') . "\n";
+echo "DONE";
+?>
+--EXPECTF--
+<wddxPacket version='1.0'><header><comment>Variables</comment></header><data><struct><var name='php_class_name'><string>SimpleXMLElement</string></var><var name='test'><struct><var name='php_class_name'><string>SimpleXMLElement</string></var></struct></var></struct></data></wddxPacket>
+DONE
\ No newline at end of file
diff --git a/ext/wddx/wddx.c b/ext/wddx/wddx.c
index b65069dd05..46ee3bba8e 100644
--- a/ext/wddx/wddx.c
+++ b/ext/wddx/wddx.c
@@ -432,6 +432,7 @@ static void php_wddx_serialize_object(wddx_packet *packet, zval *obj)
 	char *key;
 	ulong idx;
 	char tmp_buf[WDDX_BUF_LEN];
+	HashTable *objhash;
 	TSRMLS_FETCH();
 
 	MAKE_STD_ZVAL(fname);
@@ -442,7 +443,7 @@ static void php_wddx_serialize_object(wddx_packet *packet, zval *obj)
 	 * array of property names to be serialized.
 	 */
 	if (call_user_function_ex(CG(function_table), &obj, fname, &retval, 0, 0, 1, NULL TSRMLS_CC) == SUCCESS) {
-		if (retval && HASH_OF(retval)) {
+		if (retval && (objhash = HASH_OF(retval))) {
 			PHP_CLASS_ATTRIBUTES;
 			
 			PHP_SET_CLASS_ATTRIBUTES(obj);
@@ -457,15 +458,15 @@ static void php_wddx_serialize_object(wddx_packet *packet, zval *obj)
 
 			PHP_CLEANUP_CLASS_ATTRIBUTES();
 			
-			for (zend_hash_internal_pointer_reset(HASH_OF(retval));
-				 zend_hash_get_current_data(HASH_OF(retval), (void **)&varname) == SUCCESS;
-				 zend_hash_move_forward(HASH_OF(retval))) {
+			for (zend_hash_internal_pointer_reset(objhash);
+				 zend_hash_get_current_data(objhash, (void **)&varname) == SUCCESS;
+				 zend_hash_move_forward(objhash)) {
 				if (Z_TYPE_PP(varname) != IS_STRING) {
 					php_error_docref(NULL TSRMLS_CC, E_NOTICE, "__sleep should return an array only containing the names of instance-variables to serialize.");
 					continue;
 				}
 
-				if (zend_hash_find(HASH_OF(obj), Z_STRVAL_PP(varname), Z_STRLEN_PP(varname)+1, (void **)&ent) == SUCCESS) {
+				if (zend_hash_find(objhash, Z_STRVAL_PP(varname), Z_STRLEN_PP(varname)+1, (void **)&ent) == SUCCESS) {
 					php_wddx_serialize_var(packet, *ent, Z_STRVAL_PP(varname), Z_STRLEN_PP(varname) TSRMLS_CC);
 				}
 			}
@@ -489,13 +490,15 @@ static void php_wddx_serialize_object(wddx_packet *packet, zval *obj)
 
 		PHP_CLEANUP_CLASS_ATTRIBUTES();
 		
-		for (zend_hash_internal_pointer_reset(HASH_OF(obj));
-			 zend_hash_get_current_data(HASH_OF(obj), (void**)&ent) == SUCCESS;
-			 zend_hash_move_forward(HASH_OF(obj))) {
-			if (*ent == obj)
+		objhash = HASH_OF(obj);
+		for (zend_hash_internal_pointer_reset(objhash);
+			 zend_hash_get_current_data(objhash, (void**)&ent) == SUCCESS;
+			 zend_hash_move_forward(objhash)) {
+			if (*ent == obj) {
 				continue;
+			}
 
-			if (zend_hash_get_current_key_ex(HASH_OF(obj), &key, &key_len, &idx, 0, NULL) == HASH_KEY_IS_STRING) {
+			if (zend_hash_get_current_key_ex(objhash, &key, &key_len, &idx, 0, NULL) == HASH_KEY_IS_STRING) {
 				char *class_name, *prop_name;
 				
 				zend_unmangle_property_name(key, key_len-1, &class_name, &prop_name);