From: Marcus Boerger <helly@php.net>
Date: Thu, 25 May 2006 09:59:25 +0000 (+0000)
Subject: - MFH Bugfix 37587
X-Git-Tag: php-5.2.0RC1~464
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=ec79dd793d3c6f6500f4a67beb9b62eea44ad449;p=php

- MFH Bugfix 37587
---

diff --git a/NEWS b/NEWS
index 0753134003..70b0f447bb 100644
--- a/NEWS
+++ b/NEWS
@@ -44,6 +44,7 @@ PHP                                                                        NEWS
 - Added implementation of curl_multi_info_read(). (Brian)
 - Added RFC2397 (data: stream) support. (Marcus)
 - Fixed handling of extremely long paths inside tempnam() function. (Ilia)
+- Fixed bug #37587 (var without attribute causes segfault). (Marcus)
 - Fixed bug #37565 (Using reflection::export with simplexml causing a crash).
   (Marcus)
 - Fixed bug #37563 (array_key_exists performance is poor for &$array). (Ilia)
diff --git a/ext/wddx/tests/bug37587.phpt b/ext/wddx/tests/bug37587.phpt
new file mode 100755
index 0000000000..81e485325c
--- /dev/null
+++ b/ext/wddx/tests/bug37587.phpt
@@ -0,0 +1,41 @@
+--TEST--
+Bug #37587 (var without attribute causes segfault)
+--FILE--
+<?php
+
+var_dump(wddx_deserialize(file_get_contents(<<<EOF
+data:,<wddxPacket version='1.0'>
+<header/>
+<data>
+  <array length='1'>
+    <var>
+      <struct>
+        <var name='test'><string>Hello World</string></var>
+      </struct>
+    </var>
+  </array>
+</data>
+</wddxPacket>
+EOF
+)));
+
+?>
+===DONE===
+--EXPECT--
+array(1) {
+  [0]=>
+  array(1) {
+    ["test"]=>
+    string(11) "Hello World"
+  }
+}
+===DONE===
+--UEXPECT--
+array(1) {
+  [0]=>
+  array(1) {
+    [u"test"]=>
+    string(11) "Hello World"
+  }
+}
+===DONE===
diff --git a/ext/wddx/wddx.c b/ext/wddx/wddx.c
index b2833b2f11..76b136a63b 100644
--- a/ext/wddx/wddx.c
+++ b/ext/wddx/wddx.c
@@ -723,7 +723,7 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
 	if (!strcmp(name, EL_PACKET)) {
 		int i;
 		
-		for (i=0; atts[i]; i++) {
+		if (atts) for (i=0; atts[i]; i++) {
 			if (!strcmp(atts[i], EL_VERSION)) {
 				/* nothing for now */
 			}
@@ -751,7 +751,7 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
 	} else if (!strcmp(name, EL_CHAR)) {
 		int i;
 		
-		for (i = 0; atts[i]; i++) {
+		if (atts) for (i = 0; atts[i]; i++) {
 			if (!strcmp(atts[i], EL_CHAR_CODE) && atts[++i] && atts[i][0]) {
 				char tmp_buf[2];
 
@@ -771,7 +771,7 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
 	} else if (!strcmp(name, EL_BOOLEAN)) {
 		int i;
 
-		for (i = 0; atts[i]; i++) {
+		if (atts) for (i = 0; atts[i]; i++) {
 			if (!strcmp(atts[i], EL_VALUE) && atts[++i] && atts[i][0]) {
 				ent.type = ST_BOOLEAN;
 				SET_STACK_VARNAME;
@@ -812,7 +812,7 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
 	} else if (!strcmp(name, EL_VAR)) {
 		int i;
 		
-		for (i = 0; atts[i]; i++) {
+		if (atts) for (i = 0; atts[i]; i++) {
 			if (!strcmp(atts[i], EL_NAME) && atts[++i] && atts[i][0]) {
 				char *decoded;
 				int decoded_len;
@@ -829,7 +829,7 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
 		MAKE_STD_ZVAL(ent.data);
 		array_init(ent.data);
 
-		for (i = 0; atts[i]; i++) {
+		if (atts) for (i = 0; atts[i]; i++) {
 			if (!strcmp(atts[i], "fieldNames") && atts[++i] && atts[i][0]) {
 				zval *tmp;
 				char *key;
@@ -869,7 +869,7 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
 		ent.varname = NULL;
 		ent.data = NULL;
 
-		for (i = 0; atts[i]; i++) {
+		if (atts) for (i = 0; atts[i]; i++) {
 			if (!strcmp(atts[i], EL_NAME) && atts[++i] && atts[i][0]) {
 				char *decoded;
 				int decoded_len;