[php-src] PR #25349: Fix stack overflow in filter_var() and filter_var_array()
| From: | eyupcanakman | Date: | Mon, 09 Nov 2026 19:04:10 +0000 |
| Subject: | [php-src] PR #25349: Fix stack overflow in filter_var() and filter_var_array() | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-40477@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/25349
Author: eyupcanakman
filter_var() and filter_var_array() walk array input with
php_zval_filter_recursive(), which goes one C call deeper per nesting level without
checking the stack limit. On a Linux release build with an 8 MB stack, an array nested 100000 levels
deep segfaults.
The helper now checks the stack limit the same way the recursive functions in
ext/standard do. Once an exception is pending, its loop over the array elements and the
key loop in php_filter_array_handler() stop, so a second deep entry does not throw
again and chain another Error.
Stopping the key loop matches PHP-8.5, which already returns there. One visible effect on 8.4 is
that a later key's error no longer wraps an exception thrown by an earlier key's callback.
Deep enough arrays can still crash when they are freed (GH-15869), and on a Linux debug build that
happens first.
No issue was filed for it.