From: Felipe Pena Date: Tue, 16 Jun 2009 02:54:26 +0000 (+0000) Subject: - MFH: Fixed bug #48562 (Reference recursion causes segfault when used in wddx_serial... X-Git-Tag: php-5.3.0RC4~44 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=c353601a3f99b2bc072fa967e9ae79b4cd69bb05;p=php - MFH: Fixed bug #48562 (Reference recursion causes segfault when used in wddx_serialize_vars()) --- diff --git a/ext/wddx/tests/bug48562.phpt b/ext/wddx/tests/bug48562.phpt new file mode 100644 index 0000000000..d9ae376c56 --- /dev/null +++ b/ext/wddx/tests/bug48562.phpt @@ -0,0 +1,22 @@ +--TEST-- +Bug #48562 (Reference recursion causes segfault when used in wddx_serialize_vars()) +--FILE-- + +--EXPECTF-- +Warning: wddx_serialize_vars(): recursion detected in %s on line %d +string(78) "
" +string(120) "
bar" diff --git a/ext/wddx/wddx.c b/ext/wddx/wddx.c index e1139f8422..cd7e01a1ef 100644 --- a/ext/wddx/wddx.c +++ b/ext/wddx/wddx.c @@ -704,13 +704,27 @@ static void php_wddx_add_var(wddx_packet *packet, zval *name_var) php_wddx_serialize_var(packet, *val, Z_STRVAL_P(name_var), Z_STRLEN_P(name_var) TSRMLS_CC); } } else if (Z_TYPE_P(name_var) == IS_ARRAY || Z_TYPE_P(name_var) == IS_OBJECT) { + int is_array = Z_TYPE_P(name_var) == IS_ARRAY; + target_hash = HASH_OF(name_var); + if (is_array && target_hash->nApplyCount > 1) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "recursion detected"); + return; + } + zend_hash_internal_pointer_reset(target_hash); while(zend_hash_get_current_data(target_hash, (void**)&val) == SUCCESS) { + if (is_array) { + target_hash->nApplyCount++; + } + php_wddx_add_var(packet, *val); - + + if (is_array) { + target_hash->nApplyCount--; + } zend_hash_move_forward(target_hash); } }