php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #37587 var without attribute causes segfault.
Submitted: 2006-05-25 05:04 UTC Modified: 2006-05-25 11:06 UTC
From: alan at akbkhome dot com Assigned: helly (profile)
Status: Closed Package: WDDX related
PHP Version: 5.1.4 OS: *
Private report: No CVE-ID: None
View Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
If you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: alan at akbkhome dot com
New email:
PHP Version: OS:

 

 [2006-05-25 05:04 UTC] alan at akbkhome dot com 
Description:
------------
<var> with out attributes causes segfault due to no checking on att

patch to fix:
? run-tests.php
cvs diff: Diffing .
Index: wddx.c
===================================================================
RCS file: /repository/php-src/ext/wddx/wddx.c,v
retrieving revision 1.119.2.10
diff -u -r1.119.2.10 wddx.c
--- wddx.c      23 Apr 2006 16:02:05 -0000      1.119.2.10
+++ wddx.c      25 May 2006 05:00:10 -0000
@@ -811,14 +811,15 @@
                wddx_stack_push((wddx_stack *)stack, &ent, sizeof(st_entry));
        } else if (!strcmp(name, EL_VAR)) {
                int i;
-
-               for (i = 0; atts[i]; i++) {
-                       if (!strcmp(atts[i], EL_NAME) && atts[++i] && atts[i][0]) {
-                               char *decoded;
-                               int decoded_len;
-                               decoded = xml_utf8_decode(atts[i], strlen(atts[i]), &decoded_len, "ISO-8859-1");
-                               stack->varname = decoded;
-                               break;
+               if (atts) {
+                       for (i = 0; atts[i]; i++) {
+                               if (!strcmp(atts[i], EL_NAME) && atts[++i] && atts[i][0]) {
+                                       char *decoded;
+                                       int decoded_len;
+                                       decoded = xml_utf8_decode(atts[i], strlen(atts[i]), &decoded_len, "ISO-8859-1");
+                                       stack->varname = decoded;
+                                       break;
+                               }
                        }
                }
        } else if (!strcmp(name, EL_RECORDSET)) {


Reproduce code:
---------------
php -r 'var_dump(wddx_deserialize(file_get_contents("http://www.akbkhome.com/svn/hebehaven2/templates/backend/members_edit.html.rules.wddx")));

Expected result:
----------------
a nice printout

Actual result:
--------------
segfault

backtrace basically says att = 0x0

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2006-05-25 05:11 UTC] alan at akbkhome dot com 
probably worth changing all the 
for (i=0;att[i];i++) 
to
for (i=0;att && att[i];i++) 

in that whole function.
 [2006-05-25 11:06 UTC] helly@php.net 
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Tue Dec 03 17:01:29 2024 UTC