[php-src] Issue #22570: Stack overflow when serializing a deeply nested Dom\XMLDocument
[email protected] (alexandre-daubois) Fri, 3 Jul 2026 07:46:59 +0000
| Newsgroups | php.bugs |
|---|---|
| Message-ID | <[email protected]> |
Issue: https://github.com/php/php-src/issues/22570
Author: alexandre-daubois
### Description
Originally reported by @fereidani.
The following code:
```php
<?php
$depth = 1_000_000;
$xml = str_repeat('<a>', $depth) . str_repeat('</a>', $depth);
$doc = Dom\XMLDocument::createFromString("<root>$xml</root>", LIBXML_PARSEHUGE);
$doc->saveXml();
```
Resulted in a stack overflow (SIGSEGV). The XML serializer recurses through `dom_xml_serialize_element_node()` -> `dom_xml_serialization_algorithm()` for
every element child, so a document nested deeply enough overflows the C stack.
Parsing untrusted input this deep normally requires LIBXML_PARSEHUGE, but it is also reachable without it by building the tree through `Dom\HTMLDocument` and importing it into a `Dom\XMLDocument`, so a fixed depth cap wouldn't cover it.
Adding a stack limit check in `dom_xml_serialize_element_node()`, as done in bd724bd (GH-15169) for var serialization, would be the appropriate fix.
A warning was added to the documentation: https://github.com/php/doc-en/pull/5647
### PHP Version
```plain
-
```
### Operating System
_No response_