[php-src] Issue #15169: stack overflow when var serialization in ext/standard/var

From: Date: Tue, 30 Jul 2024 12:03:35 +0000
Subject: [php-src] Issue #15169: stack overflow when var serialization in ext/standard/var
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-247399@lists.php.net to get a copy of this message
Issue: https://github.com/php/php-src/issues/15169 Author: YuanchengJiang ### Description The following code: ```php <?php function var_fusion($var1, $var2, $var3) { $vars = [$var1, $var2, $var3]; foreach ($vars as $i => $v1) { foreach ($vars as $j => $v2) { if ($i < $j) { try { $result["serialize_{$j}"] = serialize($v2); } catch (Exception $e) { } } } } } class Node { public $next; } $firstNode = new Node(); $circularDoublyLinkedList = $firstNode; for ($i = 0; $i < 200000; $i++) { $currentNode = $circularDoublyLinkedList; $nextNode = $circularDoublyLinkedList->next; $newNode = new Node(); $currentNode->next = $newNode; $newNode->next = $nextNode; } $script2_connect=$circularDoublyLinkedList; var_fusion($script1_connect, $script2_connect, $random_var); ``` Resulted in this output: ``` AddressSanitizer:DEADLYSIGNAL ================================================================= ==1985328==ERROR: AddressSanitizer: stack-overflow on address 0x7fff2a15be80 (pc 0x55974e0c4609 bp 0x7fff2a15cf10 sp 0x7fff2a15be80 T0) #0 0x55974e0c4609 in php_var_serialize_intern /WorkSpace/php-src/ext/standard/var.c:983 #1 0x55974e0ca7ee in php_var_serialize_intern /WorkSpace/php-src/ext/standard/var.c:1249:8 ... #246 0x55974e0ca7ee in php_var_serialize_intern /WorkSpace/php-src/ext/standard/var.c:1249:8 SUMMARY: AddressSanitizer: stack-overflow /WorkSpace/php-src/ext/standard/var.c:983 in php_var_serialize_intern ``` Valgrind: ``` ==797883== Stack overflow in thread #1: can't grow stack to 0x1ffe801000 ==797883== ==797883== Process terminating with default action of signal 11 (SIGSEGV) ==797883== Access not within mapped region at address 0x1FFE801D28 ==797883== Stack overflow in thread #1: can't grow stack to 0x1ffe801000 ==797883== at 0x710C2E: php_var_serialize_intern (var.c:983) ==797883== If you believe this happened as a result of a stack ==797883== overflow in your program's main thread (unlikely but ==797883== possible), you can try to increase the size of the ==797883== main thread stack using the --main-stacksize= flag. ==797883== The main thread stack size used in this run was 8388608. ==797883== Stack overflow in thread #1: can't grow stack to 0x1ffe801000 ``` ### PHP Version PHP 8.4.0-dev ### Operating System ubuntu 22.04

« previous php.bugs (#247399) next »