Skip to content

Commit 833fac3

Browse files
committed
Merge branch 'PHP-8.0'
* PHP-8.0: Fix #80852: Stack-overflow when json_encode()'ing SimpleXMLElement
2 parents 1279984 + 6de2d54 commit 833fac3

File tree

2 files changed

+23
-2
lines changed

2 files changed

+23
-2
lines changed

ext/simplexml/simplexml.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1172,7 +1172,7 @@ static HashTable *sxe_get_prop_hash(zend_object *object, int is_debug) /* {{{ */
11721172
}
11731173
}
11741174

1175-
if (node->type == XML_ELEMENT_NODE && (! match_ns(sxe, node, sxe->iter.nsprefix, sxe->iter.isprefix))) {
1175+
if (node->type == XML_ELEMENT_NODE && (! match_ns(sxe, node, sxe->iter.nsprefix, sxe->iter.isprefix)) || node->type == XML_ENTITY_DECL) {
11761176
goto next_iter;
11771177
}
11781178

@@ -1871,7 +1871,7 @@ static int sxe_object_cast_ex(zend_object *readobj, zval *writeobj, int type)
18711871

18721872
if (sxe->node && sxe->node->node) {
18731873
if (sxe->node->node->children) {
1874-
contents = xmlNodeListGetString((xmlDocPtr) sxe->document->ptr, sxe->node->node->children, 1);
1874+
contents = xmlNodeListGetRawString((xmlDocPtr) sxe->document->ptr, sxe->node->node->children, 1);
18751875
}
18761876
}
18771877
}

ext/simplexml/tests/bug80852.phpt

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
--TEST--
2+
Bug #80852 (Stack-overflow when json_encode()'ing SimpleXMLElement)
3+
--SKIPIF--
4+
<?php
5+
if (!extension_loaded('simplexml')) die('skip simplexml extension not available');
6+
if (!extension_loaded('json')) die('skip json extension not available');
7+
?>
8+
--FILE--
9+
<?php
10+
$xml = '<!DOCTYPE foo [<!ENTITY xee1 "aaa"> <!ENTITY xee2 "&xee1;&xee1;"> ]><a>b&xee2;</a>';
11+
$sxe = simplexml_load_string($xml);
12+
var_dump(json_encode($sxe));
13+
var_dump($sxe);
14+
?>
15+
--EXPECT--
16+
string(11) "{"xee2":{}}"
17+
object(SimpleXMLElement)#1 (1) {
18+
["xee2"]=>
19+
object(SimpleXMLElement)#3 (0) {
20+
}
21+
}

0 commit comments

Comments
 (0)