diff --git a/NEWS b/NEWS index ba832ef05888..d7c003a50ce1 100644 --- a/NEWS +++ b/NEWS @@ -52,6 +52,10 @@ PHP NEWS - SQLite: . Fix leak when trying to close db if blob stream is still open. (ndossche) +- Standard: + . Fixed bug GH-23111 (Stack overflow in array_walk_recursive() with deeply + nested arrays). (Lazizbek Ergashev) + - Streams: . Fixed bug GH-15836 (Use-after-free when a user stream filter accesses $this->stream during the close flush). (iliaal) diff --git a/ext/standard/array.c b/ext/standard/array.c index 4527d9a80df8..6863586c81ff 100644 --- a/ext/standard/array.c +++ b/ext/standard/array.c @@ -1465,6 +1465,13 @@ static zend_result php_array_walk( * levels of recursion. */ zend_fcall_info fci = context->fci; +#ifdef ZEND_CHECK_STACK_LIMIT + if (UNEXPECTED(zend_call_stack_overflowed(EG(stack_limit)))) { + zend_call_stack_size_error(); + return FAILURE; + } +#endif + if (zend_hash_num_elements(target_hash) == 0) { return result; } diff --git a/ext/standard/tests/array/gh23111.phpt b/ext/standard/tests/array/gh23111.phpt new file mode 100644 index 000000000000..21db33a2fc75 --- /dev/null +++ b/ext/standard/tests/array/gh23111.phpt @@ -0,0 +1,27 @@ +--TEST-- +GH-23111 (Stack overflow in array_walk_recursive with deeply nested arrays) +--SKIPIF-- + +--INI-- +zend.max_allowed_stack_size=256K +--FILE-- +getMessage(), "\n"; +} +?> +--EXPECTF-- +Error: Maximum call stack size of %d bytes (zend.max_allowed_stack_size - zend.reserved_stack_size) reached. Infinite recursion?