From 4dac68221ff731717c5223bbb748400d12f40953 Mon Sep 17 00:00:00 2001 From: Xinchen Hui Date: Mon, 24 Feb 2014 16:07:02 +0800 Subject: [PATCH] Fixed NULL pointer dereference in php_url_encode_hash_ex --- ext/standard/http.c | 27 ++++++++++++++++----------- 1 file changed, 16 insertions(+), 11 deletions(-) diff --git a/ext/standard/http.c b/ext/standard/http.c index cceaa48aa6..4263a5f03c 100644 --- a/ext/standard/http.c +++ b/ext/standard/http.c @@ -59,18 +59,23 @@ PHPAPI int php_url_encode_hash_ex(HashTable *ht, smart_str *formstr, zend_hash_move_forward(ht) ) { /* handling for private & protected object properties */ - prop_name = key->val; - prop_len = key->len; - if (key && key->val[0] == '\0' && type != NULL) { - const char *tmp, *prop_name; - int prop_len; - - zend_object *zobj = Z_OBJ_P(type); - if (zend_check_property_access(zobj, key TSRMLS_CC) != SUCCESS) { - /* private or protected property access outside of the class */ - continue; + if (key) { + if (key->val[0] == '\0' && type != NULL) { + const char *tmp; + + zend_object *zobj = Z_OBJ_P(type); + if (zend_check_property_access(zobj, key TSRMLS_CC) != SUCCESS) { + /* private or protected property access outside of the class */ + continue; + } + zend_unmangle_property_name_ex(key->val, key->len, &tmp, &prop_name, &prop_len); + } else { + prop_name = key->val; + prop_len = key->len; } - zend_unmangle_property_name_ex(key->val, key->len, &tmp, &prop_name, &prop_len); + } else { + prop_name = NULL; + prop_len = 0; } if ((zdata = zend_hash_get_current_data_ex(ht, NULL)) == NULL) { -- 2.40.0