[php-src] PR #23848: main/streams: Bound user stream wrapper recursion with a depth counter

From: Date: Tue, 22 Sep 2026 14:29:59 +0000
Subject: [php-src] PR #23848: main/streams: Bound user stream wrapper recursion with a depth counter
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-38721@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/23848 Author: iliaal The userspace wrapper guard only compared the filename being opened against the currently open one, so a wrapper whose stream_open() opens a different path at every level, an incrementing counter in the URL for instance, recursed until the C stack ran out. A per-request nesting counter shared by user_wrapper_opener() and user_wrapper_opendir() now rejects opens past 64 levels with the existing "infinite recursion prevented" error, and is decremented on every exit including the bailout branch. The counter sits at the end of php_file_globals so the struct keeps its layout for extensions built against the 8.4 header.

« previous php.git-pulls (#38721) next »