clones/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-09-21 09:57:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix GH-12208: SimpleXML infinite loop when a cast is used inside a foreach

Browse Source 
Closes GH-12229.
This commit is contained in:
Niels Dossche 2023-09-17 13:39:19 +02:00
parent 39a9e561f9
commit 486276f0f9
3 changed files with 30 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
NEWS
View File

@ -15,6 +15,8 @@ PHP NEWS
within foreach). (nielsdos)
. Fixed bug GH-12223 (Entity reference produces infinite loop in
var_dump/print_r). (nielsdos)
. Fixed bug GH-12208 (SimpleXML infinite loop when a cast is used inside a
foreach). (nielsdos)
28 Sep 2023, PHP 8.1.24

4
ext/simplexml/simplexml.c
View File

@ -1860,7 +1860,7 @@ static int sxe_object_cast_ex(zend_object *readobj, zval *writeobj, int type)
sxe = php_sxe_fetch_object(readobj);
if (type == _IS_BOOL) {
node = php_sxe_get_first_node(sxe, NULL);
node = php_sxe_get_first_node_non_destructive(sxe, NULL);
if (node) {
ZVAL_TRUE(writeobj);
} else {
@ -1870,7 +1870,7 @@ static int sxe_object_cast_ex(zend_object *readobj, zval *writeobj, int type)
}
if (sxe->iter.type != SXE_ITER_NONE) {
node = php_sxe_get_first_node(sxe, NULL);
node = php_sxe_get_first_node_non_destructive(sxe, NULL);
if (node) {
contents = xmlNodeListGetString((xmlDocPtr) sxe->document->ptr, node->children, 1);
}

26
ext/simplexml/tests/gh12208.phpt Normal file
View File

@ -0,0 +1,26 @@
--TEST--
GH-12208 (SimpleXML infinite loop when a cast is used inside a foreach)
--EXTENSIONS--
simplexml
--FILE--
<?php
$xml = "<root><a>1</a><a>2</a></root>";
$xml = simplexml_load_string($xml);
$a = $xml->a;
foreach ($a as $test) {
var_dump((string) $a->current());
var_dump((string) $a);
var_dump((bool) $a);
}
?>
--EXPECT--
string(1) "1"
string(1) "1"
bool(true)
string(1) "2"
string(1) "1"
bool(true)