From bdb50267f7680e67e574dfe7f3cfd17fb587bc5d Mon Sep 17 00:00:00 2001
From: Rob Richards <rrichards@php.net>
Date: Thu, 11 Sep 2008 14:16:36 +0000
Subject: [PATCH] fix bug #45901 (wddx_serialize_value crash with
 SimpleXMLElement object) add test

---
 ext/wddx/tests/bug45901.phpt | 18 ++++++++++++++++++
 ext/wddx/wddx.c              | 22 ++++++++++++----------
 2 files changed, 30 insertions(+), 10 deletions(-)
 create mode 100644 ext/wddx/tests/bug45901.phpt

diff --git a/ext/wddx/tests/bug45901.phpt b/ext/wddx/tests/bug45901.phpt
new file mode 100644
index 0000000000..4084ccbf20
--- /dev/null
+++ b/ext/wddx/tests/bug45901.phpt
@@ -0,0 +1,18 @@
+--TEST--
+Bug #45901 (wddx_serialize_value crash with SimpleXMLElement object)
+--SKIPIF--
+<?php
+if (!extension_loaded("wddx")) print "skip";
+if (!extension_loaded("simplexml")) print "skip SimpleXML not present";
+?>
+--FILE--
+<?php
+
+$xml = new SimpleXMLElement('<data></data>');
+$xml->addChild('test');
+echo wddx_serialize_value($xml, 'Variables') . "\n";
+echo "DONE";
+?>
+--EXPECTF--
+<wddxPacket version='1.0'><header><comment>Variables</comment></header><data><struct><var name='php_class_name'><string>SimpleXMLElement</string></var><var name='test'><struct><var name='php_class_name'><string>SimpleXMLElement</string></var></struct></var></struct></data></wddxPacket>
+DONE
\ No newline at end of file
diff --git a/ext/wddx/wddx.c b/ext/wddx/wddx.c
index c4439d284b..baf9c5eaf2 100644
--- a/ext/wddx/wddx.c
+++ b/ext/wddx/wddx.c
@@ -466,6 +466,7 @@ static void php_wddx_serialize_object(wddx_packet *packet, zval *obj)
 	char *key;
 	ulong idx;
 	char tmp_buf[WDDX_BUF_LEN];
+	HashTable *objhash;
 	TSRMLS_FETCH();
 
 	MAKE_STD_ZVAL(fname);
@@ -476,7 +477,7 @@ static void php_wddx_serialize_object(wddx_packet *packet, zval *obj)
 	 * array of property names to be serialized.
 	 */
 	if (call_user_function_ex(CG(function_table), &obj, fname, &retval, 0, 0, 1, NULL TSRMLS_CC) == SUCCESS) {
-		if (retval && HASH_OF(retval)) {
+		if (retval && (objhash = HASH_OF(retval))) {
 			PHP_CLASS_ATTRIBUTES;
 			
 			PHP_SET_CLASS_ATTRIBUTES(obj);
@@ -491,15 +492,15 @@ static void php_wddx_serialize_object(wddx_packet *packet, zval *obj)
 
 			PHP_CLEANUP_CLASS_ATTRIBUTES();
 			
-			for (zend_hash_internal_pointer_reset(HASH_OF(retval));
-				 zend_hash_get_current_data(HASH_OF(retval), (void **)&varname) == SUCCESS;
-				 zend_hash_move_forward(HASH_OF(retval))) {
+			for (zend_hash_internal_pointer_reset(objhash);
+				 zend_hash_get_current_data(objhash, (void **)&varname) == SUCCESS;
+				 zend_hash_move_forward(objhash)) {
 				if (Z_TYPE_PP(varname) != IS_STRING) {
-					php_error_docref(NULL TSRMLS_CC, E_NOTICE, "__sleep should return an array only containing the names of instance-variables to serialize");
+					php_error_docref(NULL TSRMLS_CC, E_NOTICE, "__sleep should return an array only containing the names of instance-variables to serialize.");
 					continue;
 				}
 
-				if (zend_hash_find(HASH_OF(obj), Z_STRVAL_PP(varname), Z_STRLEN_PP(varname)+1, (void **)&ent) == SUCCESS) {
+				if (zend_hash_find(objhash, Z_STRVAL_PP(varname), Z_STRLEN_PP(varname)+1, (void **)&ent) == SUCCESS) {
 					php_wddx_serialize_var(packet, *ent, Z_STRVAL_PP(varname), Z_STRLEN_PP(varname) TSRMLS_CC);
 				}
 			}
@@ -523,14 +524,15 @@ static void php_wddx_serialize_object(wddx_packet *packet, zval *obj)
 
 		PHP_CLEANUP_CLASS_ATTRIBUTES();
 		
-		for (zend_hash_internal_pointer_reset(HASH_OF(obj));
-			 zend_hash_get_current_data(HASH_OF(obj), (void**)&ent) == SUCCESS;
-			 zend_hash_move_forward(HASH_OF(obj))) {
+		objhash = HASH_OF(obj);
+		for (zend_hash_internal_pointer_reset(objhash);
+			 zend_hash_get_current_data(objhash, (void**)&ent) == SUCCESS;
+			 zend_hash_move_forward(objhash)) {
 			if (*ent == obj) {
 				continue;
 			}
 
-			if (zend_hash_get_current_key_ex(HASH_OF(obj), &key, &key_len, &idx, 0, NULL) == HASH_KEY_IS_STRING) {
+			if (zend_hash_get_current_key_ex(objhash, &key, &key_len, &idx, 0, NULL) == HASH_KEY_IS_STRING) {
 				char *class_name, *prop_name;
 				
 				zend_unmangle_property_name(key, key_len-1, &class_name, &prop_name);
-- 
2.50.1