php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.0'

Browse Source 
* PHP-8.0:
  Fix #80852: Stack-overflow when json_encode()'ing SimpleXMLElement
This commit is contained in:
Stanislav Malyshev
2021-04-26 20:51:46 -07:00
parent 12799847a6 6de2d54425
commit 833fac34d0
2 changed files with 23 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
ext/simplexml/simplexml.c
View File

@@ -1172,7 +1172,7 @@ static HashTable *sxe_get_prop_hash(zend_object *object, int is_debug) /* {{{ */
}
}
if (node->type == XML_ELEMENT_NODE && (! match_ns(sxe, node, sxe->iter.nsprefix, sxe->iter.isprefix))) {
if (node->type == XML_ELEMENT_NODE && (! match_ns(sxe, node, sxe->iter.nsprefix, sxe->iter.isprefix)) || node->type == XML_ENTITY_DECL) {
goto next_iter;
}
@@ -1871,7 +1871,7 @@ static int sxe_object_cast_ex(zend_object *readobj, zval *writeobj, int type)
if (sxe->node && sxe->node->node) {
if (sxe->node->node->children) {
contents = xmlNodeListGetString((xmlDocPtr) sxe->document->ptr, sxe->node->node->children, 1);
contents = xmlNodeListGetRawString((xmlDocPtr) sxe->document->ptr, sxe->node->node->children, 1);
}
}
}

21
ext/simplexml/tests/bug80852.phpt Normal file
View File

@@ -0,0 +1,21 @@
--TEST--
Bug #80852 (Stack-overflow when json_encode()'ing SimpleXMLElement)
--SKIPIF--
<?php
if (!extension_loaded('simplexml')) die('skip simplexml extension not available');
if (!extension_loaded('json')) die('skip json extension not available');
?>
--FILE--
<?php
$xml = '<!DOCTYPE foo [<!ENTITY xee1 "aaa"> <!ENTITY xee2 "&xee1;&xee1;"> ]><a>b&xee2;</a>';
$sxe = simplexml_load_string($xml);
var_dump(json_encode($sxe));
var_dump($sxe);
?>
--EXPECT--
string(11) "{"xee2":{}}"
object(SimpleXMLElement)#1 (1) {
["xee2"]=>
object(SimpleXMLElement)#3 (0) {
}
}