#37587 [Opn->Csd]: var without attribute causes segfault.

ID: 37587 Updated by: helly@php.net Reported By: alan at akbkhome dot com -Status: Open +Status: Closed Bug Type: WDDX related -Operating System: linux +Operating System: * -PHP Version: 5CVS-2006-05-25 (CVS) +PHP Version: 5.1.4 -Assigned To: +Assigned To: helly New Comment: This bug has been fixed in CVS. Snapshots of the sources are packaged every three hours; this change will be in the next snapshot. You can grab the snapshot at http://snaps.php.net/. Thank you for the report, and for helping us make PHP better. Previous Comments: ------------------------------------------------------------------------ [2006-05-25 05:11:31] alan at akbkhome dot com probably worth changing all the for (i=0;att[i];i++) to for (i=0;att && att[i];i++) in that whole function. ------------------------------------------------------------------------ [2006-05-25 05:04:01] alan at akbkhome dot com Description: ------------ <var> with out attributes causes segfault due to no checking on att patch to fix: ? run-tests.php cvs diff: Diffing . Index: wddx.c =================================================================== RCS file: /repository/php-src/ext/wddx/wddx.c,v retrieving revision 1.119.2.10 diff -u -r1.119.2.10 wddx.c --- wddx.c 23 Apr 2006 16:02:05 -0000 1.119.2.10 +++ wddx.c 25 May 2006 05:00:10 -0000 @@ -811,14 +811,15 @@ wddx_stack_push((wddx_stack *)stack, &ent, sizeof(st_entry)); } else if (!strcmp(name, EL_VAR)) { int i; - - for (i = 0; atts[i]; i++) { - if (!strcmp(atts[i], EL_NAME) && atts[++i] && atts[i][0]) { - char *decoded; - int decoded_len; - decoded = xml_utf8_decode(atts[i], strlen(atts[i]), &decoded_len, "ISO-8859-1"); - stack->varname = decoded; - break; + if (atts) { + for (i = 0; atts[i]; i++) { + if (!strcmp(atts[i], EL_NAME) && atts[++i] && atts[i][0]) { + char *decoded; + int decoded_len; + decoded = xml_utf8_decode(atts[i], strlen(atts[i]), &decoded_len, "ISO-8859-1"); + stack->varname = decoded; + break; + } } } } else if (!strcmp(name, EL_RECORDSET)) { Reproduce code: --------------- php -r 'var_dump(wddx_deserialize(file_get_contents("http://www.akbkhome.com/svn/hebehaven2/templates/backend/members_edit.html.rules.wddx"))); Expected result: ---------------- a nice printout Actual result: -------------- segfault backtrace basically says att = 0x0 ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=37587&edit=1