Description:
------------
If the xml document has <var name="xxx"> tag without </var>, the varname variable will never freed and causing memory leak equal to the strlen(varname).

<snippet func php_wddx_push_element>
	} else if (!strcmp((char *)name, EL_VAR)) {
		int i;

		if (atts) for (i = 0; atts[i]; i++) {
			if (!strcmp((char *)atts[i], EL_NAME) && atts[i+1] && atts[i+1][0]) {
				if (stack->varname) efree(stack->varname);
				stack->varname = estrdup((char *)atts[i+1]); //strdup the varname
				break;
			}
		}
	} else if (!strcmp((char *)name, EL_RECORDSET)) {
</snippet>

Patch is simple, free the varname when destroy the stack:

--- a/ext/wddx/wddx.c
+++ b/ext/wddx/wddx.c
@@ -241,6 +241,9 @@ static int wddx_stack_destroy(wddx_stack *stack)
                }
                efree(stack->elements);
        }
+       if (stack->varname) {
+               efree(stack->varname);
+       }
        return SUCCESS;
 }
 /* }}} */

This bug may lead to DoS on the server as the leak is significant for each request, the poc is leaking 8MB of memory without any special configuration.
compiled with only --enable-debug --enable-wddx

Test script:
---------------
<?php
$xml=<<<XML
<?xml version='1.0'?>
<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
<wddxPacket>
<var name="
XML;

$xml .= str_repeat('F',0x800000);

$xml .= <<<XML
">
</wddxPacket>
XML;
var_dump(wddx_deserialize($xml));
?>

Expected result:
----------------
NULL

Actual result:
--------------
$~ php7 --ini
Configuration File (php.ini) Path: /opt/php7/lib
Loaded Configuration File:         (none)
Scan for additional .ini files in: (none)
Additional .ini files parsed:      (none)

$~ php7 -v
PHP 7.2.0-dev (cli) (built: Sep 26 2016 15:29:49) ( NTS DEBUG )
Copyright (c) 1997-2016 The PHP Group
Zend Engine v3.1.0-dev, Copyright (c) 1998-2016 Zend Technologies

$~ php7 wddx.php
NULL
[Mon Sep 26 15:43:39 2016]  Script:  '/opt/php7/bin/wddx.php'
/home/vps/git/php-src/ext/wddx/wddx.c(796) :  Freeing 0x00007f410d200000 (8388609 bytes), script=/opt/php7/bin/wddx.php
=== Total 1 memory leaks detected ===