felipe Tue Jun 16 02:59:10 2009 UTC
Added files: (Branch: PHP_5_2)
/php-src/ext/wddx/tests bug48562.phpt
Modified files:
/php-src NEWS
/php-src/ext/wddx wddx.c
Log:
- MFH: Fixed bug #48562 (Reference recursion causes segfault when used in
wddx_serialize_vars())
http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.2027.2.547.2.1558&r2=1.2027.2.547.2.1559&diff_format=u
Index: php-src/NEWS
diff -u php-src/NEWS:1.2027.2.547.2.1558 php-src/NEWS:1.2027.2.547.2.1559
--- php-src/NEWS:1.2027.2.547.2.1558 Mon Jun 15 22:11:47 2009
+++ php-src/NEWS Tue Jun 16 02:59:09 2009
@@ -1,6 +1,8 @@
PHP NEWS
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
?? Jun 2009, PHP 5.2.10
+- Fixed bug #48562 (Reference recursion causes segfault when used in
+ wddx_serialize_vars()). (Felipe)
- Fixed bug #48557 (Numeric string keys in Apache Hashmaps are not cast to
integers). (David Zuelke)
- Fixed bug #48514 (cURL extension uses same resource name for simple and
http://cvs.php.net/viewvc.cgi/php-src/ext/wddx/wddx.c?r1=1.119.2.10.2.22&r2=1.119.2.10.2.23&diff_format=u
Index: php-src/ext/wddx/wddx.c
diff -u php-src/ext/wddx/wddx.c:1.119.2.10.2.22
php-src/ext/wddx/wddx.c:1.119.2.10.2.23
--- php-src/ext/wddx/wddx.c:1.119.2.10.2.22 Wed Dec 31 11:17:46 2008
+++ php-src/ext/wddx/wddx.c Tue Jun 16 02:59:10 2009
@@ -16,7 +16,7 @@
+----------------------------------------------------------------------+
*/
-/* $Id: wddx.c,v 1.119.2.10.2.22 2008/12/31 11:17:46 sebastian Exp $ */
+/* $Id: wddx.c,v 1.119.2.10.2.23 2009/06/16 02:59:10 felipe Exp $ */
#ifdef HAVE_CONFIG_H
#include "config.h"
@@ -672,13 +672,27 @@
}
else if (Z_TYPE_P(name_var) == IS_ARRAY || Z_TYPE_P(name_var) ==
IS_OBJECT)
{
+ int is_array = Z_TYPE_P(name_var) == IS_ARRAY;
+
target_hash = HASH_OF(name_var);
+
+ if (is_array && target_hash->nApplyCount > 1) {
+ php_error_docref(NULL TSRMLS_CC, E_WARNING, "recursion
detected");
+ return;
+ }
zend_hash_internal_pointer_reset(target_hash);
while(zend_hash_get_current_data(target_hash, (void**)&val) ==
SUCCESS) {
+ if (is_array) {
+ target_hash->nApplyCount++;
+ }
+
php_wddx_add_var(packet, *val);
-
+
+ if (is_array) {
+ target_hash->nApplyCount--;
+ }
zend_hash_move_forward(target_hash);
}
}
http://cvs.php.net/viewvc.cgi/php-src/ext/wddx/tests/bug48562.phpt?view=markup&rev=1.1
Index: php-src/ext/wddx/tests/bug48562.phpt
+++ php-src/ext/wddx/tests/bug48562.phpt
--TEST--
Bug #48562 (Reference recursion causes segfault when used in
wddx_serialize_vars())
--FILE--
<?php
$foo = 'bar';
$a['x'] = 'foo';
$a['x'] = &$a;
var_dump(wddx_serialize_vars($a));
$a['x'] = 'foo';
$a['x'] = $a;
var_dump(wddx_serialize_vars($a));
?>
--EXPECTF--
Warning: wddx_serialize_vars(): recursion detected in %s on line %d
string(78) "<wddxPacket
version='1.0'><header/><data><struct></struct></data></wddxPacket>"
string(120) "<wddxPacket version='1.0'><header/><data><struct><var
name='foo'><string>bar</string></var></struct></data></wddxPacket>"
--
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
