From f8047d997c2831847f867b484bcad7238986dc55 Mon Sep 17 00:00:00 2001 From: cuishuang Date: Sun, 6 Sep 2026 17:36:52 +0800 Subject: [PATCH 1/2] PHP json_encode(): Check depth range before narrowing --- ext/json/json.c | 5 +++++ ext/json/tests/json_encode_depth.phpt | 19 +++++++++++++++++++ 2 files changed, 24 insertions(+) create mode 100644 ext/json/tests/json_encode_depth.phpt diff --git a/ext/json/json.c b/ext/json/json.c index 04a62f52152f..b71b9aafe997 100644 --- a/ext/json/json.c +++ b/ext/json/json.c @@ -250,6 +250,11 @@ PHP_FUNCTION(json_encode) Z_PARAM_LONG(depth) ZEND_PARSE_PARAMETERS_END(); + if (ZEND_LONG_EXCEEDS_INT(depth)) { + zend_argument_value_error(3, "must be between %d and %d", INT_MIN, INT_MAX); + RETURN_THROWS(); + } + php_json_encode_init(&encoder); encoder.max_depth = (int)depth; php_json_encode_zval(&buf, parameter, (int)options, &encoder); diff --git a/ext/json/tests/json_encode_depth.phpt b/ext/json/tests/json_encode_depth.phpt new file mode 100644 index 000000000000..c455b266da37 --- /dev/null +++ b/ext/json/tests/json_encode_depth.phpt @@ -0,0 +1,19 @@ +--TEST-- +json_encode() rejects depth values outside the encoder range +--SKIPIF-- + +--FILE-- +getMessage(), "\n"; + } +} + +?> +--EXPECT-- +json_encode(): Argument #3 ($depth) must be between -2147483648 and 2147483647 +json_encode(): Argument #3 ($depth) must be between -2147483648 and 2147483647 From 72bbf0d7fc0dcecf62a95cf649f518ce09ad3427 Mon Sep 17 00:00:00 2001 From: cuishuang Date: Sun, 6 Sep 2026 22:52:39 +0800 Subject: [PATCH 2/2] Improve json_encode() depth test --- ext/json/tests/json_encode_depth.phpt | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/ext/json/tests/json_encode_depth.phpt b/ext/json/tests/json_encode_depth.phpt index c455b266da37..075228da472c 100644 --- a/ext/json/tests/json_encode_depth.phpt +++ b/ext/json/tests/json_encode_depth.phpt @@ -8,12 +8,12 @@ json_encode() rejects depth values outside the encoder range foreach ([2147483648, -2147483649] as $depth) { try { json_encode([], depth: $depth); - } catch (ValueError $e) { - echo $e->getMessage(), "\n"; + } catch (Throwable $e) { + echo $e::class, ': ', $e->getMessage(), "\n"; } } ?> --EXPECT-- -json_encode(): Argument #3 ($depth) must be between -2147483648 and 2147483647 -json_encode(): Argument #3 ($depth) must be between -2147483648 and 2147483647 +ValueError: json_encode(): Argument #3 ($depth) must be between -2147483648 and 2147483647 +ValueError: json_encode(): Argument #3 ($depth) must be between -2147483648 and 2147483647