[php-src] Issue #22570: Stack overflow when serializing a deeply nested Dom\XMLDocument

[email protected] (alexandre-daubois) Fri, 3 Jul 2026 07:46:59 +0000
Newsgroups php.bugs
Message-ID <[email protected]>
Issue: https://github.com/php/php-src/issues/22570
Author: alexandre-daubois

### Description

Originally reported by @fereidani.

The following code:

```php
<?php
$depth = 1_000_000;
$xml = str_repeat('<a>', $depth) . str_repeat('</a>', $depth);

$doc = Dom\XMLDocument::createFromString("<root>$xml</root>", LIBXML_PARSEHUGE);
$doc->saveXml();
```

Resulted in a stack overflow (SIGSEGV). The XML serializer recurses through `dom_xml_serialize_element_node()` -> `dom_xml_serialization_algorithm()` for
every element child, so a document nested deeply enough overflows the C stack.

Parsing untrusted input this deep normally requires LIBXML_PARSEHUGE, but it is also reachable without it by building the tree through `Dom\HTMLDocument` and importing it into a `Dom\XMLDocument`, so a fixed depth cap wouldn't cover it.

Adding a stack limit check in `dom_xml_serialize_element_node()`, as done in bd724bd (GH-15169) for var serialization, would be the appropriate fix.

A warning was added to the documentation: https://github.com/php/doc-en/pull/5647

### PHP Version

```plain
-
```

### Operating System

_No response_