php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #45901 wddx_serialize_value crash with SimpleXMLElement object
Submitted: 2008-08-24 04:54 UTC Modified: 2008-09-11 14:25 UTC
From: aragon at phat dot za dot net Assigned:
Status: Closed Package: WDDX related
PHP Version: 5.2.6, 5.3CVS OS: FreeBSD 7.0-STABLE
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: aragon at phat dot za dot net
New email:
PHP Version: OS:

 

 [2008-08-24 04:54 UTC] aragon at phat dot za dot net
Description:
------------
If wddx_serialize_value is called on a SimpleXMLElement object that has at least one child, the PHP script enters an infinite loop consuming full CPU and allocating memory until the memory size limit is reached, after which the script dies.


Reproduce code:
---------------
<?

$xml = new SimpleXMLElement('<data></data>');
$xml->addChild('test');
echo wddx_serialize_value($xml, 'Variables');
echo 'hello world';

?>


Expected result:
----------------
To see the WDDX output and 'hello world' :)

Actual result:
--------------
Potential DoS against web server and this log entry:

[Sun Aug 24 06:44:19 2008] [error] [client 127.0.0.1] PHP Fatal error:  Allowed memory size of 134217728 bytes exhausted (tried to allocate 133955606 bytes) in /usr/home/aragon/dev/admin.infinite/test.php on line 5


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2008-09-03 01:00 UTC] php-bugs at lists dot php dot net
No feedback was provided for this bug for over a week, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".
 [2008-09-10 23:23 UTC] felipe@php.net
I can reproduce using 5.3CVS.
 [2008-09-11 14:25 UTC] rrichards@php.net
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.


 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Apr 25 21:01:36 2024 UTC