From: Antony Dovgal <tony2001@php.net>
Date: Mon, 14 Aug 2006 08:18:01 +0000 (+0000)
Subject: fix segfault and leak in ext/xmlrpc
X-Git-Tag: php-5.2.0RC2~36
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=cb9686b0e5a6ac1e745dd4f48e64f55f91dd89aa;p=php

fix segfault and leak in ext/xmlrpc
add tests
---

diff --git a/ext/xmlrpc/tests/001.phpt b/ext/xmlrpc/tests/001.phpt
new file mode 100644
index 0000000000..99fd958d29
--- /dev/null
+++ b/ext/xmlrpc/tests/001.phpt
@@ -0,0 +1,66 @@
+--TEST--
+xmlrpc_encode_request() with wrong arguments
+--SKIPIF--
+<?php if (!extension_loaded("xmlrpc")) print "skip"; ?>
+--FILE--
+<?php
+
+var_dump(xmlrpc_encode_request(-1, 1));
+var_dump(xmlrpc_encode_request("", 1));
+var_dump(xmlrpc_encode_request(array(), 1));
+var_dump(xmlrpc_encode_request(3.4, 1));
+
+echo "Done\n";
+?>
+--EXPECTF--	
+string(174) "<?xml version="1.0" encoding="iso-8859-1"?>
+<methodCall>
+<methodName>-1</methodName>
+<params>
+ <param>
+  <value>
+   <int>1</int>
+  </value>
+ </param>
+</params>
+</methodCall>
+"
+string(160) "<?xml version="1.0" encoding="iso-8859-1"?>
+<methodCall>
+<methodName/>
+<params>
+ <param>
+  <value>
+   <int>1</int>
+  </value>
+ </param>
+</params>
+</methodCall>
+"
+
+Notice: Array to string conversion in %s on line %d
+string(177) "<?xml version="1.0" encoding="iso-8859-1"?>
+<methodCall>
+<methodName>Array</methodName>
+<params>
+ <param>
+  <value>
+   <int>1</int>
+  </value>
+ </param>
+</params>
+</methodCall>
+"
+string(175) "<?xml version="1.0" encoding="iso-8859-1"?>
+<methodCall>
+<methodName>3.4</methodName>
+<params>
+ <param>
+  <value>
+   <int>1</int>
+  </value>
+ </param>
+</params>
+</methodCall>
+"
+Done
diff --git a/ext/xmlrpc/tests/002.phpt b/ext/xmlrpc/tests/002.phpt
new file mode 100644
index 0000000000..c8d722b808
--- /dev/null
+++ b/ext/xmlrpc/tests/002.phpt
@@ -0,0 +1,56 @@
+--TEST--
+xmlrpc_encode_request() and various arguments
+--SKIPIF--
+<?php if (!extension_loaded("xmlrpc")) print "skip"; ?>
+--FILE--
+<?php
+
+$r = xmlrpc_encode_request("method", array());
+var_dump(xmlrpc_decode_request($r, $method));
+var_dump($method);
+
+$r = xmlrpc_encode_request("method", 1);
+var_dump(xmlrpc_decode_request($r, $method));
+var_dump($method);
+
+$r = xmlrpc_encode_request("method", 'param');
+var_dump(xmlrpc_decode_request($r, $method));
+var_dump($method);
+
+$r = xmlrpc_encode_request(-1, "");
+var_dump(xmlrpc_decode_request($r, $method));
+var_dump($method);
+
+$r = xmlrpc_encode_request(array(), 1);
+var_dump(xmlrpc_decode_request($r, $method));
+var_dump($method);
+
+echo "Done\n";
+?>
+--EXPECTF--	
+array(0) {
+}
+string(6) "method"
+array(1) {
+  [0]=>
+  int(1)
+}
+string(6) "method"
+array(1) {
+  [0]=>
+  string(5) "param"
+}
+string(6) "method"
+array(1) {
+  [0]=>
+  string(0) ""
+}
+string(2) "-1"
+
+Notice: Array to string conversion in %s on line %d
+array(1) {
+  [0]=>
+  int(1)
+}
+string(5) "Array"
+Done
diff --git a/ext/xmlrpc/xmlrpc-epi-php.c b/ext/xmlrpc/xmlrpc-epi-php.c
index 69fe7534e9..0ed30b79a1 100644
--- a/ext/xmlrpc/xmlrpc-epi-php.c
+++ b/ext/xmlrpc/xmlrpc-epi-php.c
@@ -671,6 +671,7 @@ PHP_FUNCTION(xmlrpc_encode_request)
 			if (Z_TYPE_PP(method) == IS_NULL) {
 				XMLRPC_RequestSetRequestType(xRequest, xmlrpc_request_response);
 			} else {
+				convert_to_string_ex(method);
 				XMLRPC_RequestSetMethodName(xRequest, Z_STRVAL_PP(method));
 				XMLRPC_RequestSetRequestType(xRequest, xmlrpc_request_call);
 			}
@@ -740,7 +741,7 @@ zval* decode_request_worker (zval* xml_in, zval* encoding_in, zval* method_name_
 
       if(XMLRPC_RequestGetRequestType(response) == xmlrpc_request_call) {
          if(method_name_out) {
-            convert_to_string(method_name_out);
+            zval_dtor(method_name_out);
             Z_TYPE_P(method_name_out) = IS_STRING;
             Z_STRVAL_P(method_name_out) = estrdup(XMLRPC_RequestGetMethodName(response));
             Z_STRLEN_P(method_name_out) = strlen(Z_STRVAL_P(method_name_out));