Fix GH-22570: stack overflow serializing a deeply nested Dom\XMLDocument#22576
Closed
iliaal wants to merge 1 commit into
Closed
Fix GH-22570: stack overflow serializing a deeply nested Dom\XMLDocument#22576iliaal wants to merge 1 commit into
iliaal wants to merge 1 commit into
Conversation
…cument The new-DOM XML serializer recurses through dom_xml_serialization_algorithm() for every element child, so a document nested deeply enough overflows the C stack and crashes during saveXml() or innerHTML. Add a stack-limit check at the dispatcher, throwing an Error on overflow, mirroring bd724bd. Gate the "Could not save document" warning and the innerHTML not-well-formed exception with !EG(exception) so the thrown Error propagates cleanly instead of being accompanied by a warning or replaced with the wrong exception type. Fixes phpGH-22570
devnexen
approved these changes
Jul 3, 2026
Member
|
The test seems to fail frequently in nightly. Can you please check? https://github.com/php/php-src/actions/runs/28725922777/job/85183280824 |
Contributor
Author
|
That's a timeout, not a wrong result. The test builds a 100k-node tree, and on the macOS ZTS runner that clears the 120s limit; the serialization it actually checks bails at the stack guard instantly. I couldn't reproduce the slowdown locally (runs in ~0.02s here, even with the OS stack constrained to 512K to mimic the ZTS thread), so the cost looks like a per-node constant factor specific to that runner. At |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A deeply nested
Dom\XMLDocumentoverflows the C stack when serialized, since the XML serializer recurses per element child. Adds a stack-limit check at the dispatcher (throwing anErroron overflow, like bd724bd forvarserialization) and gates thesaveXmlwarning andinnerHTMLexception with!EG(exception)so the thrownErrorisn't masked or replaced.Fixes #22570