felipe Tue Jun 16 02:59:10 2009 UTC Added files: (Branch: PHP_5_2) /php-src/ext/wddx/tests bug48562.phpt
Modified files: /php-src NEWS /php-src/ext/wddx wddx.c Log: - MFH: Fixed bug #48562 (Reference recursion causes segfault when used in wddx_serialize_vars()) http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.2027.2.547.2.1558&r2=1.2027.2.547.2.1559&diff_format=u Index: php-src/NEWS diff -u php-src/NEWS:1.2027.2.547.2.1558 php-src/NEWS:1.2027.2.547.2.1559 --- php-src/NEWS:1.2027.2.547.2.1558 Mon Jun 15 22:11:47 2009 +++ php-src/NEWS Tue Jun 16 02:59:09 2009 @@ -1,6 +1,8 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? Jun 2009, PHP 5.2.10 +- Fixed bug #48562 (Reference recursion causes segfault when used in + wddx_serialize_vars()). (Felipe) - Fixed bug #48557 (Numeric string keys in Apache Hashmaps are not cast to integers). (David Zuelke) - Fixed bug #48514 (cURL extension uses same resource name for simple and http://cvs.php.net/viewvc.cgi/php-src/ext/wddx/wddx.c?r1=1.119.2.10.2.22&r2=1.119.2.10.2.23&diff_format=u Index: php-src/ext/wddx/wddx.c diff -u php-src/ext/wddx/wddx.c:1.119.2.10.2.22 php-src/ext/wddx/wddx.c:1.119.2.10.2.23 --- php-src/ext/wddx/wddx.c:1.119.2.10.2.22 Wed Dec 31 11:17:46 2008 +++ php-src/ext/wddx/wddx.c Tue Jun 16 02:59:10 2009 @@ -16,7 +16,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: wddx.c,v 1.119.2.10.2.22 2008/12/31 11:17:46 sebastian Exp $ */ +/* $Id: wddx.c,v 1.119.2.10.2.23 2009/06/16 02:59:10 felipe Exp $ */ #ifdef HAVE_CONFIG_H #include "config.h" @@ -672,13 +672,27 @@ } else if (Z_TYPE_P(name_var) == IS_ARRAY || Z_TYPE_P(name_var) == IS_OBJECT) { + int is_array = Z_TYPE_P(name_var) == IS_ARRAY; + target_hash = HASH_OF(name_var); + + if (is_array && target_hash->nApplyCount > 1) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "recursion detected"); + return; + } zend_hash_internal_pointer_reset(target_hash); while(zend_hash_get_current_data(target_hash, (void**)&val) == SUCCESS) { + if (is_array) { + target_hash->nApplyCount++; + } + php_wddx_add_var(packet, *val); - + + if (is_array) { + target_hash->nApplyCount--; + } zend_hash_move_forward(target_hash); } } http://cvs.php.net/viewvc.cgi/php-src/ext/wddx/tests/bug48562.phpt?view=markup&rev=1.1 Index: php-src/ext/wddx/tests/bug48562.phpt +++ php-src/ext/wddx/tests/bug48562.phpt --TEST-- Bug #48562 (Reference recursion causes segfault when used in wddx_serialize_vars()) --FILE-- <?php $foo = 'bar'; $a['x'] = 'foo'; $a['x'] = &$a; var_dump(wddx_serialize_vars($a)); $a['x'] = 'foo'; $a['x'] = $a; var_dump(wddx_serialize_vars($a)); ?> --EXPECTF-- Warning: wddx_serialize_vars(): recursion detected in %s on line %d string(78) "<wddxPacket version='1.0'><header/><data><struct></struct></data></wddxPacket>" string(120) "<wddxPacket version='1.0'><header/><data><struct><var name='foo'><string>bar</string></var></struct></data></wddxPacket>" -- PHP CVS Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php