#43495 [Opn->Csd]: array_merge_recursive crash with recursive arrays

ID: 43495 Updated by: iliaa@php.net Reported By: nicholsr@php.net -Status: Open +Status: Closed Bug Type: Reproducible crash Operating System: any PHP Version: 5.2.5 New Comment: This bug has been fixed in CVS. Snapshots of the sources are packaged every three hours; this change will be in the next snapshot. You can grab the snapshot at http://snaps.php.net/. Thank you for the report, and for helping us make PHP better. Previous Comments: ------------------------------------------------------------------------ [2007-12-04 11:25:35] nicholsr@php.net Description: ------------ This is basically the same as bug 42752 but in the array_merge_recursive rather than the array_walk recursive code. The fix is the same. The detection of recursion used in array_merge_recursive is incorrect so it is possible to pass recursive arrays that cause unbounded recursion, leading to stack overflow. Reproduce code: --------------- <?php $a=array("key1"=>array("key2"=>array())); $a["key1"]["key2"]["key3"]=&$a; $b=array("key1"=>array("key2"=>array())); $b["key1"]["key2"]["key3"]=&$b; array_merge_recursive ($a,$b); echo "reached the end \n"; ?> Expected result: ---------------- reached the end Actual result: -------------- crash ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=43495&edit=1