[php-src] PHP-8.0: Merge branch 'PHP-7.4' into PHP-8.0

Author: Stanislav Malyshev (smalyshev) Date: 2021-04-26T20:50:29-07:00 Commit: https://github.com/php/php-src/commit/6de2d544252b25823a7e8889f65530c621d1b782 Raw diff: https://github.com/php/php-src/commit/6de2d544252b25823a7e8889f65530c621d1b782.diff Merge branch 'PHP-7.4' into PHP-8.0 * PHP-7.4: Fix #80852: Stack-overflow when json_encode()'ing SimpleXMLElement Changed paths: A ext/simplexml/tests/bug80852.phpt M ext/simplexml/simplexml.c Diff: diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c index 4ed41d758762..3101d2f64c9a 100644 --- a/ext/simplexml/simplexml.c +++ b/ext/simplexml/simplexml.c @@ -1172,7 +1172,7 @@ static HashTable *sxe_get_prop_hash(zend_object *object, int is_debug) /* {{{ */ } } - if (node->type == XML_ELEMENT_NODE && (! match_ns(sxe, node, sxe->iter.nsprefix, sxe->iter.isprefix))) { + if (node->type == XML_ELEMENT_NODE && (! match_ns(sxe, node, sxe->iter.nsprefix, sxe->iter.isprefix)) || node->type == XML_ENTITY_DECL) { goto next_iter; } @@ -1871,7 +1871,7 @@ static int sxe_object_cast_ex(zend_object *readobj, zval *writeobj, int type) if (sxe->node && sxe->node->node) { if (sxe->node->node->children) { - contents = xmlNodeListGetString((xmlDocPtr) sxe->document->ptr, sxe->node->node->children, 1); + contents = xmlNodeListGetRawString((xmlDocPtr) sxe->document->ptr, sxe->node->node->children, 1); } } } diff --git a/ext/simplexml/tests/bug80852.phpt b/ext/simplexml/tests/bug80852.phpt new file mode 100644 index 000000000000..abda2deda1e1 --- /dev/null +++ b/ext/simplexml/tests/bug80852.phpt @@ -0,0 +1,21 @@ +--TEST-- +Bug #80852 (Stack-overflow when json_encode()'ing SimpleXMLElement) +--SKIPIF-- +<?php +if (!extension_loaded('simplexml')) die('skip simplexml extension not available'); +if (!extension_loaded('json')) die('skip json extension not available'); +?> +--FILE-- +<?php +$xml = '<!DOCTYPE foo [<!ENTITY xee1 "aaa"> <!ENTITY xee2 "&xee1;&xee1;"> ]><a>b&xee2;</a>'; +$sxe = simplexml_load_string($xml); +var_dump(json_encode($sxe)); +var_dump($sxe); +?> +--EXPECT-- +string(11) "{"xee2":{}}" +object(SimpleXMLElement)#1 (1) { + ["xee2"]=> + object(SimpleXMLElement)#3 (0) { + } +}