[php-src] Issue #20836: Stack overflow in mbstring variable conversion with recursive array references

[email protected] (vi3tL0u1s)
Newsgroups php.bugs
Message-ID <slOvARmM6RxuDQYyXNSHFak2wDUdqTWM2uwcZXrtLqU@main.internal.php.net>
Issue: https://github.com/php/php-src/issues/20836
Author: vi3tL0u1s

### Description

The following code:

```php
<?php
$a[] = $b[] = &$a;
var_dump(mb_convert_variables('utf-8', 'utf-8', $a), $a);
```

Resulted in this output:
```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==2593609==ERROR: AddressSanitizer: stack-overflow on address 0x7ffdba5e0ff8 (pc 0x5643a833ccc2 bp 0x7ffdba5e1010 sp 0x7ffdba5e0fe0 T0)
    #0 0x5643a833ccc2 in zend_mm_get_next_free_slot /path/to/php-src/Zend/zend_alloc.c:1320
    #1 0x5643a833d5f9 in zend_mm_alloc_small /path/to/php-src/Zend/zend_alloc.c:1409
    #2 0x5643a833db62 in zend_mm_alloc_heap /path/to/php-src/Zend/zend_alloc.c:1487
    #3 0x5643a8344adf in _emalloc /path/to/php-src/Zend/zend_alloc.c:2783
    #4 0x5643a86431bd in zend_array_dup /path/to/php-src/Zend/zend_hash.c:2458
    #5 0x5643a77b94a2 in mb_recursive_convert_variable /path/to/php-src/ext/mbstring/mbstring.c:3787
    #6 0x5643a77b99fe in mb_recursive_convert_variable /path/to/php-src/ext/mbstring/mbstring.c:3814
    #7 0x5643a77b99fe in mb_recursive_convert_variable /path/to/php-src/ext/mbstring/mbstring.c:3814
    ... (hundreds of recursive calls)
    #248 0x5643a77b99fe in mb_recursive_convert_variable /path/to/php-src/ext/mbstring/mbstring.c:3814

SUMMARY: AddressSanitizer: stack-overflow /path/to/php-src/Zend/zend_alloc.c:1320 in zend_mm_get_next_free_slot
==2593609==ABORTING
```

### Commit

```
cb63e4f998b
```

### Configurations

```bash
CC="clang" CXX="clang++" CFLAGS="-fsanitize=address -g -O0" CXXFLAGS="-fsanitize=address -g -O0" ./configure --enable-debug --enable-address-sanitizer --disable-shared --with-pic
```


### PHP Version

```plain
PHP 8.6.0-dev (cli) (built: Jan  5 2026 10:22:05) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.6.0-dev, Copyright (c) Zend Technologies
    with Zend OPcache v8.6.0-dev, Copyright (c), by Zend Technologies
```

### Operating System

Ubuntu 22.04
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.