[php-src] PR #25219: Fix stack overflow in mb_check_encoding() and mb_convert_encoding()
| From: | eyupcanakman | Date: | Thu, 05 Nov 2026 17:34:19 +0000 |
| Subject: | [php-src] PR #25219: Fix stack overflow in mb_check_encoding() and mb_convert_encoding() | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-40332@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/25219
Author: eyupcanakman
mb_check_encoding() and mb_convert_encoding() walk array arguments with
php_mb_check_encoding_recursive() and php_mb_convert_encoding_recursive().
Neither helper looks at the stack limit before going one level deeper, so a deep enough array
crashes the process. mb_convert_encoding() already segfaults at 30000 levels with the
default stack.
mbstring.c has had mb_check_stack_limit() since GH-20836, but only
mb_convert_variables() uses it. Both helpers now call it and return early once the
Error is thrown, so the walk stops there and a second nested array never adds a chained Error. The
helper moves up the file so the convert path can see it.
There is no GitHub issue for this.