Skip to content

Commit 9f7e8b7

Browse files
cmb69smalyshev
authored andcommitted
Fix #80852: Stack-overflow when json_encode()'ing SimpleXMLElement
We ignore `XML_ENTITY_DECL` nodes when getting the hash of the properties of a `SimpleXMLElement`.
1 parent 729cd8b commit 9f7e8b7

File tree

2 files changed

+23
-2
lines changed

2 files changed

+23
-2
lines changed

ext/simplexml/simplexml.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1192,7 +1192,7 @@ static HashTable *sxe_get_prop_hash(zval *object, int is_debug) /* {{{ */
11921192
}
11931193
}
11941194

1195-
if (node->type == XML_ELEMENT_NODE && (! match_ns(sxe, node, sxe->iter.nsprefix, sxe->iter.isprefix))) {
1195+
if (node->type == XML_ELEMENT_NODE && (! match_ns(sxe, node, sxe->iter.nsprefix, sxe->iter.isprefix)) || node->type == XML_ENTITY_DECL) {
11961196
goto next_iter;
11971197
}
11981198

@@ -1889,7 +1889,7 @@ static int sxe_object_cast_ex(zval *readobj, zval *writeobj, int type)
18891889

18901890
if (sxe->node && sxe->node->node) {
18911891
if (sxe->node->node->children) {
1892-
contents = xmlNodeListGetString((xmlDocPtr) sxe->document->ptr, sxe->node->node->children, 1);
1892+
contents = xmlNodeListGetRawString((xmlDocPtr) sxe->document->ptr, sxe->node->node->children, 1);
18931893
}
18941894
}
18951895
}

ext/simplexml/tests/bug80852.phpt

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
--TEST--
2+
Bug #80852 (Stack-overflow when json_encode()'ing SimpleXMLElement)
3+
--SKIPIF--
4+
<?php
5+
if (!extension_loaded('simplexml')) die('skip simplexml extension not available');
6+
if (!extension_loaded('json')) die('skip json extension not available');
7+
?>
8+
--FILE--
9+
<?php
10+
$xml = '<!DOCTYPE foo [<!ENTITY xee1 "aaa"> <!ENTITY xee2 "&xee1;&xee1;"> ]><a>b&xee2;</a>';
11+
$sxe = simplexml_load_string($xml);
12+
var_dump(json_encode($sxe));
13+
var_dump($sxe);
14+
?>
15+
--EXPECT--
16+
string(11) "{"xee2":{}}"
17+
object(SimpleXMLElement)#1 (1) {
18+
["xee2"]=>
19+
object(SimpleXMLElement)#3 (0) {
20+
}
21+
}

0 commit comments

Comments
 (0)