# wddx_deserialize null dereference

wddx_deserialize passed an invalid base64 binary value to php_base64_decode, which returned NULL; the unchecked return was stored as a string zval, causing a null dereference crash.

- Payout: $500
- Severity: medium
- Program: Internet Bug Bounty
- Credited: fms
- Disclosed: 2019-10-31
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/161216
- Library page: https://bugbountylibrary.com/r/h1%3A161216
- Tags: domain:oss impact:dos kind:bounty platform:hackerone sev:medium tech:php technique:source-review vuln:deserialization vuln:memory-corruption

**Target:** PHP ext/wddx wddx_deserialize (EL_BINARY element)
**Root cause:** php_base64_decode returns NULL on invalid base64 input, but wddx.c line 896 stores the result via ZVAL_STR without a NULL check, dereferencing a null pointer.
**Steps:**
1. Craft a WDDX packet containing a <binary> element whose content is invalid base64 (e.g. non-base64 characters).
2. Call wddx_deserialize() on the packet.
3. php_base64_decode returns NULL for the invalid input.
4. ZVAL_STR(&ent1->data, new_str) is executed with new_str == NULL, triggering a null dereference / crash.
**How found:** Code reading of wddx.c: noticed the return value of php_base64_decode was used directly without checking for NULL, then confirmed by feeding invalid base64 through wddx_deserialize.
**Insight:** When auditing deserializers, grep for decode/alloc helpers whose failure return (NULL/false) is assigned straight into a zval or struct without a check; malformed-encoding inputs are the cheapest trigger.