Bug #73755 [Asn]: Infinite recursion within unset() leads to SEGV

Edit report at https://bugs.php.net/bug.php?id=73755&edit=1 ID: 73755 Updated by: yohgaki@php.net Reported by: kshah at fortinet dot com Summary: Infinite recursion within unset() leads to SEGV Status: Assigned Type: Bug Package: Arrays related Operating System: Linux PHP Version: master-Git-2016-12-16 (Git) Assigned To: dmitry Block user comment: N Private report: N New Comment: Out of curiosity, I've tested the script on my system. I've got expected result. ArrayAccessReferenceProxy::__construct(0) ArrayAccessReferenceProxy::offsetUnset(0, name) Segmentation fault Kashah, I guess you are using Suhosin extension. The stack limit error should come from it. (Or module like Suhosin that can limit stack usage at least) Previous Comments: ------------------------------------------------------------------------ [2018-11-08 01:17:30] yohgaki@php.net 256 may be too small. A thousand is the limit for Ruby/Python. Anyway, I thought we don't have arbitrary recursion limit like Perl and let PHP consume stack until system limit, i.e. segfault. If PHP is going to have recursion limit, it should be configurable via INI. IMO. ------------------------------------------------------------------------ [2018-11-01 09:41:15] ryan dot jentzsch at gmail dot com Looks to be fixed in version 7.2.10 running this code produces: PHP Fatal error: Uncaught Error: Maximum function nesting level of '256' reached, aborting! Linux Mint 19 (Tara) Kernel 4.19 ------------------------------------------------------------------------ [2017-01-05 21:46:05] kshah at fortinet dot com I looked at the classification on https://wiki.php.net/security and I was unable to see how this is "not" a security issue. Could you explain how it is not a security issue. ------------------------------------------------------------------------ [2017-01-05 21:28:31] stas@php.net This definitely looks like infinite recursion, but if its buffer overflow may indicate some check missing in recursion handling. Dmitry, could you take another look and see if there's not anything we have missed? In any case, not a security issue, please refer to https://wiki.php.net/security for classification. ------------------------------------------------------------------------ [2017-01-05 19:48:59] kshah at fortinet dot com PHP Security Team, Any Update?? ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=73755 -- Edit this bug report at https://bugs.php.net/bug.php?id=73755&edit=1