#45901 [NoF->Ver]: wddx_serialize_value crash with SimpleXMLElement object

ID: 45901 Updated by: felipe@php.net Reported By: aragon at phat dot za dot net -Status: No Feedback +Status: Verified Bug Type: WDDX related Operating System: FreeBSD 7.0-STABLE -PHP Version: 5.2.6 +PHP Version: 5.2.6, 5.3CVS New Comment: I can reproduce using 5.3CVS. Previous Comments: ------------------------------------------------------------------------ [2008-09-03 01:00:01] php-bugs at lists dot php dot net No feedback was provided for this bug for over a week, so it is being suspended automatically. If you are able to provide the information that was originally requested, please do so and change the status of the bug back to "Open". ------------------------------------------------------------------------ [2008-08-26 22:33:47] jani@php.net Please try using this CVS snapshot: http://snaps.php.net/php5.2-latest.tar.gz For Windows (zip): http://snaps.php.net/win32/php5.2-win32-latest.zip For Windows (installer): http://snaps.php.net/win32/php5.2-win32-installer-latest.msi ------------------------------------------------------------------------ [2008-08-24 04:54:12] aragon at phat dot za dot net Description: ------------ If wddx_serialize_value is called on a SimpleXMLElement object that has at least one child, the PHP script enters an infinite loop consuming full CPU and allocating memory until the memory size limit is reached, after which the script dies. Reproduce code: --------------- <? $xml = new SimpleXMLElement('<data></data>'); $xml->addChild('test'); echo wddx_serialize_value($xml, 'Variables'); echo 'hello world'; ?> Expected result: ---------------- To see the WDDX output and 'hello world' :) Actual result: -------------- Potential DoS against web server and this log entry: [Sun Aug 24 06:44:19 2008] [error] [client 127.0.0.1] PHP Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 133955606 bytes) in /usr/home/aragon/dev/admin.infinite/test.php on line 5 ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=45901&edit=1