[soap] reject self-referential schema group and attributeGroup fix-up - #285
Open
iliaal wants to merge 1 commit into
Open
[soap] reject self-referential schema group and attributeGroup fix-up#285iliaal wants to merge 1 commit into
iliaal wants to merge 1 commit into
Conversation
Schema fix-up now tracks types currently being fixed in ctx->fixupInProgress and raises 'recursive group'/'recursive attributeGroup' errors on re-entry, so a <group> or <attributeGroup> whose content model references itself can no longer overflow the C stack during WSDL parsing; sibling audit found the same unguarded re-entry path in schema_attributegroup_fixup() and it is guarded by the same set.
iliaal
force-pushed
the
fix/soap-schema-selfref-group-84
branch
from
August 26, 2026 12:45
c3dccbf to
4d879fc
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A self-referential or in a WSDL schema overflowed the C stack in schema_content_model_fixup()/schema_attributegroup_fixup() and segfaulted the process. A ctx->fixupInProgress set now records each type the fix-up pass enters and raises a 'Parsing Schema: recursive ...' E_ERROR on re-entry; a sibling audit found the identical unguarded re-entry in schema_attributegroup_fixup(), which the same set now guards. Two new tests cover both shapes: the reproduction segfaults PHP-8.4 branches without the patch and produces a catchable SoapFault with it.