mirror of
https://github.com/php/php-src.git
synced 2026-10-28 17:56:50 +08:00
3584a98bda
- Replace bailout on OOM with UnwindExit - Properly reset various globals that may be accessed during startup Fix GHSA-w8hw-w9fx-j79w (CVE-2026-109618) Fix GHSA-6wmf-4rv5-p3rp (CVE-2026-109619) Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com> Co-authored-by: Jakub Zelenka <bukka@php.net> Co-authored-by: Nora Dossche <7771979+ndossche@users.noreply.github.com> Co-authored-by: Nicolas Grekas <nicolas.grekas@gmail.com>
28 lines
725 B
PHP
28 lines
725 B
PHP
--TEST--
|
|
xml_parse() doesn't reach hard limit on namespaced attributes
|
|
--EXTENSIONS--
|
|
xml
|
|
--SKIPIF--
|
|
<?php
|
|
if (!@xml_parser_create_ns()) die("skip xml_parser_create_ns() not supported");
|
|
?>
|
|
--INI--
|
|
memory_limit=8M
|
|
--FILE--
|
|
<?php
|
|
// 8 KB URI x 4000 attributes == ~32 MB of expanded names from ~50 KB of input
|
|
$uri = str_repeat("u", 8192);
|
|
$data = "<r xmlns:p=\"$uri\"";
|
|
for ($i = 0; $i < 4000; $i++) {
|
|
$data .= " p:a$i=\"\"";
|
|
}
|
|
$data .= "/>";
|
|
|
|
$parser = xml_parser_create_ns();
|
|
xml_set_element_handler($parser, function () {}, function () {});
|
|
xml_parse($parser, $data, true);
|
|
echo "not reached\n";
|
|
?>
|
|
--EXPECTF--
|
|
Fatal error: Allowed memory size of 8388608 bytes exhausted %S(tried to allocate %d bytes) in %s on line %d
|