[php-src] PR #25406: Fix GH-23089: stack overflow in array_merge_recursive()
| From: | akasakariko | Date: | Thu, 12 Nov 2026 03:39:29 +0000 |
| Subject: | [php-src] PR #25406: Fix GH-23089: stack overflow in array_merge_recursive() | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-40561@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/25406
Author: akasakariko
Fixes #23089
Check the Zend stack limit in
array_merge_recursive() so deeply nested merges throw an
Error before exhausting the native stack, using the same guard as
array_replace_recursive()
Continues #23091, which was closed without merging; the object cleanup raised in that review is
already present through #23340
The original input still encounters the independent array destruction overflow in #15869 during
shutdown after reporting the Error, which also reproduces with the merge call removed
The regression frees its input iteratively to isolate recursive merging and runs under
AddressSanitizer
Validation on macOS arm64
- Debug NTS Standard and Zend suite: 8296 passed, 631 skipped, 1 expected failure
- Debug ZTS with AddressSanitizer array tests and the next index overflow regression: 840 passed, 14
skipped
- Original input with iterative cleanup and tracing JIT: catches Error and exits normally in both
builds
- Additional ASan stack checks: existing stack_limit_002 and
stack_limit_004 Fiber failures reproduced on the unmodified baseline