Skip to content

PHP json_encode(): Check depth range before narrowing - #23589

Open
cuishuang wants to merge 2 commits into
php:masterfrom
cuishuang:master
Open

PHP json_encode(): Check depth range before narrowing#23589
cuishuang wants to merge 2 commits into
php:masterfrom
cuishuang:master

Conversation

@cuishuang

Copy link
Copy Markdown

json_encode() accepts $depth as a zend_long, but stores it directly in the encoder's int max_depth field.

On 64-bit builds, values outside the range of int were silently narrowed before encoding. This could produce platform-dependent behavior.

Check the value with ZEND_LONG_EXCEEDS_INT() before assigning it to encoder.max_depth, and throw a ValueError when it cannot be represented as an int.

Values within the existing range, including depth == 0 and negative values, retain their current behavior.

The regression test covers values above INT_MAX and below INT_MIN.

Comment thread ext/json/tests/json_encode_depth.phpt Outdated
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants