[php-src] PR #24671: Guard var_export() against native stack overflow (GH-24605)
| From: | labishbardiya | Date: | Sun, 25 Oct 2026 07:15:54 +0000 |
| Subject: | [php-src] PR #24671: Guard var_export() against native stack overflow (GH-24605) | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-39850@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24671
Author: labishbardiya
## Summary
Add native stack overflow protection to
var_export() so deeply nested arrays and
objects raise a catchable Error instead of risking a segmentation fault.
Refs GH-24605.
## Root cause
php_var_export_ex() recursively processes nested structures without checking the native
stack limit.
Other recursive PHP operations already use Zend's stack-limit protection.
## Changes
- Add the native stack-limit guard to php_var_export_ex().
- Return FAILURE when the stack limit is exceeded.
- Propagate failures from recursive object property exports.
- Preserve cleanup on failure paths.
- Add a PHPT regression test for deeply nested arrays and objects.
## Validation
**Environment:** macOS ARM64, PHP 8.4.28-dev, debug build.
- PHP compiled successfully.
- GH-24605 regression test: PASS.
- Full test suite: 11,549 PASS, 1 FAIL, 3 XFAIL, 9,795 SKIP.
The unrelated unexpected failure occurred in php_ini_loaded_file.phpt. It is caused by
inherited -c configuration arguments from the test harness.
The same test passes when run without those arguments. A correction is already proposed in PHP PR
#24406.
The full suite has therefore not been demonstrated to pass without unexpected failures under the
standard make test invocation.
## Scope
This change addresses only the var_export() portion of GH-24605.
The print_r() and unserialize() cases remain outside this PR's scope.