#37587 [NEW]: var without attribute causes segfault.

From: alan at akbkhome dot com Operating system: linux PHP version: 5CVS-2006-05-25 (CVS) PHP Bug Type: WDDX related Bug description: var without attribute causes segfault. Description: ------------ <var> with out attributes causes segfault due to no checking on att patch to fix: ? run-tests.php cvs diff: Diffing . Index: wddx.c =================================================================== RCS file: /repository/php-src/ext/wddx/wddx.c,v retrieving revision 1.119.2.10 diff -u -r1.119.2.10 wddx.c --- wddx.c 23 Apr 2006 16:02:05 -0000 1.119.2.10 +++ wddx.c 25 May 2006 05:00:10 -0000 @@ -811,14 +811,15 @@ wddx_stack_push((wddx_stack *)stack, &ent, sizeof(st_entry)); } else if (!strcmp(name, EL_VAR)) { int i; - - for (i = 0; atts[i]; i++) { - if (!strcmp(atts[i], EL_NAME) && atts[++i] && atts[i][0]) { - char *decoded; - int decoded_len; - decoded = xml_utf8_decode(atts[i], strlen(atts[i]), &decoded_len, "ISO-8859-1"); - stack->varname = decoded; - break; + if (atts) { + for (i = 0; atts[i]; i++) { + if (!strcmp(atts[i], EL_NAME) && atts[++i] && atts[i][0]) { + char *decoded; + int decoded_len; + decoded = xml_utf8_decode(atts[i], strlen(atts[i]), &decoded_len, "ISO-8859-1"); + stack->varname = decoded; + break; + } } } } else if (!strcmp(name, EL_RECORDSET)) { Reproduce code: --------------- php -r 'var_dump(wddx_deserialize(file_get_contents("http://www.akbkhome.com/svn/hebehaven2/templates/backend/members_edit.html.rules.wddx"))); Expected result: ---------------- a nice printout Actual result: -------------- segfault backtrace basically says att = 0x0 -- Edit bug report at http://bugs.php.net/?id=37587&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=37587&r=trysnapshot44 Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=37587&r=trysnapshot52 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=37587&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=37587&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=37587&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=37587&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=37587&r=needscript Try newer version: http://bugs.php.net/fix.php?id=37587&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=37587&r=support Expected behavior: http://bugs.php.net/fix.php?id=37587&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=37587&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=37587&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=37587&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=37587&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=37587&r=dst IIS Stability: http://bugs.php.net/fix.php?id=37587&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=37587&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=37587&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=37587&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=37587&r=mysqlcfg