[soap] reject self-referential schema group and attributeGroup fix-up - #285
Open
iliaal wants to merge 1 commit into
Open
[soap] reject self-referential schema group and attributeGroup fix-up#285iliaal wants to merge 1 commit into
iliaal wants to merge 1 commit into
Conversation
Schema fix-up now tracks types currently being fixed in ctx->fixupInProgress and raises 'recursive group'/'recursive attributeGroup' errors on re-entry, so a <group> or <attributeGroup> whose content model references itself can no longer overflow the C stack during WSDL parsing; sibling audit found the same unguarded re-entry path in schema_attributegroup_fixup() and it is guarded by the same set.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Parsing a WSDL whose schema contains a self-referential or (a group whose sequence references itself via a group ref, or the attributeGroup equivalent) overflowed the C stack in schema_content_model_fixup()/schema_attributegroup_fixup(), segfaulting the process. The schema fix-up pass now records each type it enters in a ctx->fixupInProgress set and raises a 'Parsing Schema: recursive ...' E_ERROR on re-entry, matching the style of the existing unresolved-ref errors; the sibling audit found the identical unguarded re-entry path in schema_attributegroup_fixup() and it is guarded by the same set. Reproduction segfaults all PHP-8.4 branches before the patch and now produces a catchable SoapFault, with two new tests and no failures across ext/soap/tests.