You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
alpine-pkg/testing/php5.4/d06-u013-CVE-2016-7413.patch

47 lines
1.3 KiB

Index: php5-5.4.45/ext/wddx/tests/bug72860.phpt
===================================================================
--- /dev/null 1970-01-01 00:00:00.000000000 +0000
+++ php5-5.4.45/ext/wddx/tests/bug72860.phpt 2016-12-09 16:08:37.893564834 +0100
@@ -0,0 +1,27 @@
+--TEST--
+Bug #72860: wddx_deserialize use-after-free
+--SKIPIF--
+<?php
+if (!extension_loaded('wddx')) {
+ die('skip. wddx not available');
+}
+?>
+--FILE--
+<?php
+
+$xml=<<<XML
+<?xml version='1.0'?>
+<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
+<wddxPacket version='1.0'>
+ <recordset fieldNames='F'>
+ <field name='F'>
+ </recordset>
+</wddxPacket>
+XML;
+
+var_dump(wddx_deserialize($xml));
+?>
+DONE
+--EXPECT--
+NULL
+DONE
\ No newline at end of file
Index: php5-5.4.45/ext/wddx/wddx.c
===================================================================
--- php5-5.4.45.orig/ext/wddx/wddx.c 2016-12-09 16:08:37.901564613 +0100
+++ php5-5.4.45/ext/wddx/wddx.c 2016-12-09 16:08:37.893564834 +0100
@@ -232,7 +232,8 @@
if (stack->elements) {
for (i = 0; i < stack->top; i++) {
- if (((st_entry *)stack->elements[i])->data) {
+ if (((st_entry *)stack->elements[i])->data
+ && ((st_entry *)stack->elements[i])->type != ST_FIELD) {
zval_ptr_dtor(&((st_entry *)stack->elements[i])->data);
}
if (((st_entry *)stack->elements[i])->varname) {