# NULL Pointer Dereference while unserialize php object

PHP wddx_deserialize ignores object_init_ex failure when php_class_name names an interface/abstract class, leaving a NULL object that crashes the process.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by: hoangnguyen
- Disclosed: 2019-11-12
- CVE: CVE-2016-10162
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/195688
- Library page: https://bugbountylibrary.com/r/h1%3A195688
- Tags: area:oss domain:oss impact:dos kind:bounty platform:hackerone sev:medium tech:php technique:source-review vuln:deserialization vuln:dos vuln:memory-corruption

**Target:** PHP wddx_deserialize / object_init_ex
**Root cause:** object_init_ex returns FAILURE and sets the zval object pointer to NULL for interface/trait/abstract classes, but the caller does not check the return value and proceeds to zend_hash_merge on Z_OBJPROP(obj), dereferencing NULL.
**Steps:**
1. Craft a WDDX packet with a struct var named `php_class_name` whose string value is an interface/abstract class such as `Throwable`.
2. Call `wddx_deserialize($xml)`.
3. object_init_ex fails (cannot instantiate abstract class) and sets Z_OBJ_P(arg)=NULL, but the caller ignores FAILURE.
4. zend_hash_merge(Z_OBJPROP(obj), ...) dereferences the NULL object pointer, crashing PHP.
**How found:** Code review of the wddx deserializer: noticed object_init_ex's return value is unchecked, and that the failure path explicitly sets the object pointer to NULL, which the subsequent zend_hash_merge would dereference.
**Insight:** In deserializers that honor a user-supplied class name, feed interface/trait/abstract class names: the instantiation failure path may leave a NULL zval that later code dereferences unchecked.