[PHP-CVS] [php-src] master: Merge branch 'PHP-8.5'

Author: Weilin Du (LamentXU123)
Date: 2026-08-09T00:14:34+08:00

Commit: https://github.com/php/php-src/commit/c742440fef7eecc3e35de5e524c87f130ffe0367
Raw diff: https://github.com/php/php-src/commit/c742440fef7eecc3e35de5e524c87f130ffe0367.diff

Merge branch 'PHP-8.5'

* PHP-8.5:
  Fix GH-23120: DOMNode::isEqualNode stack overflow on deeply nested trees (#23140)

Changed paths:
  A  ext/dom/tests/gh23120.phpt
  M  NEWS
  M  ext/dom/node.c


Diff:

diff --git a/NEWS b/NEWS
index fef83b8412c5..8c84bee9f71f 100644
--- a/NEWS
+++ b/NEWS
@@ -97,6 +97,8 @@ PHP                                                                        NEWS
 - DOM:
   . Fixed bug GH-22825 (DOMElement::setAttribute() fails silently when the DTD
     declares a default value for the attribute). (iliaal)
+  . Fixed bug GH-23120 (Stack overflow when comparing deeply nested DOM nodes
+    with DOMNode::isEqualNode()). (Weilin Du)
 
 - Embed:
   . Made php-cli functionality available in embed builds. (henderkes)
diff --git a/ext/dom/node.c b/ext/dom/node.c
index e0af66227014..cc063df66960 100644
--- a/ext/dom/node.c
+++ b/ext/dom/node.c
@@ -1735,11 +1735,27 @@ static bool php_dom_is_equal_attr(const xmlAttr *this_attr, const xmlAttr *other
 		&& php_dom_node_is_content_equal((const xmlNode *) this_attr, (const xmlNode *) other_attr);
 }
 
+static zend_always_inline bool php_dom_node_is_equal_node_check_stack_limit(void)
+{
+#ifdef ZEND_CHECK_STACK_LIMIT
+	return zend_call_stack_overflowed(EG(stack_limit));
+#else
+	return false;
+#endif
+}
+
 static bool php_dom_node_is_equal_node(const xmlNode *this, const xmlNode *other, bool spec_compliant)
 {
 	ZEND_ASSERT(this != NULL);
 	ZEND_ASSERT(other != NULL);
 
+	if (UNEXPECTED(php_dom_node_is_equal_node_check_stack_limit())) {
+		if (!EG(exception)) {
+			zend_throw_error(NULL, "Maximum call stack size reached.");
+		}
+		return false;
+	}
+
 	if (this->type != other->type) {
 		return false;
 	}
@@ -1800,6 +1816,7 @@ static void dom_node_is_equal_node_common(INTERNAL_FUNCTION_PARAMETERS, bool mod
 	zval *id, *node;
 	xmlNodePtr otherp, nodep;
 	dom_object *intern;
+	bool result;
 
 	id = ZEND_THIS;
 	ZEND_PARSE_PARAMETERS_START(1, 1)
@@ -1822,7 +1839,11 @@ static void dom_node_is_equal_node_common(INTERNAL_FUNCTION_PARAMETERS, bool mod
 		RETURN_BOOL(nodep == NULL && otherp == NULL);
 	}
 
-	RETURN_BOOL(php_dom_node_is_equal_node(nodep, otherp, modern));
+	result = php_dom_node_is_equal_node(nodep, otherp, modern);
+	if (UNEXPECTED(EG(exception))) {
+		RETURN_THROWS();
+	}
+	RETURN_BOOL(result);
 }
 
 PHP_METHOD(DOMNode, isEqualNode)
diff --git a/ext/dom/tests/gh23120.phpt b/ext/dom/tests/gh23120.phpt
new file mode 100644
index 000000000000..511314d9cbba
--- /dev/null
+++ b/ext/dom/tests/gh23120.phpt
@@ -0,0 +1,42 @@
+--TEST--
+GH-23120 (Stack overflow when comparing deeply nested DOM nodes)
+--EXTENSIONS--
+dom
+--SKIPIF--
+<?php
+if (ini_get('zend.max_allowed_stack_size') === false) {
+    die('skip No stack limit support');
+}
+if (getenv('SKIP_ASAN')) {
+    die('skip ASAN needs different stack limit setting due to more stack space usage');
+}
+?>
+--INI--
+zend.max_allowed_stack_size=512K
+--FILE--
+<?php
+function create_deep_document(): DOMDocument {
+    $doc = new DOMDocument();
+    $node = $doc->createElement('leaf', 'x');
+
+    for ($i = 0; $i < 10000; $i++) {
+        $parent = $doc->createElement('a');
+        $parent->appendChild($node);
+        $node = $parent;
+    }
+
+    $doc->appendChild($node);
+    return $doc;
+}
+
+$doc1 = create_deep_document();
+$doc2 = create_deep_document();
+
+try {
+    var_dump($doc1->documentElement->isEqualNode($doc2->documentElement));
+} catch (\Error $e) {
+    echo $e::class, ": ", $e->getMessage(), "\n";
+}
+?>
+--EXPECT--
+Error: Maximum call stack size reached.