[php-src] Issue #23112: stack overflow in array/sanitizer

[email protected] (djarfluka)
Newsgroups php.bugs
Message-ID <[email protected]>
Issue: https://github.com/php/php-src/issues/23112
Author: djarfluka

### Description

The following code:

```php
<?php
$a=[]; for($i=0;$i<1000000;$i++){$a=['k'=>$a];}
$b=array_merge_recursive($a,$a);
```

Resulted in this output:
```
    #226 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #227 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #228 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #229 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #230 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #231 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #232 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #233 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #234 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #235 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #236 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #237 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #238 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #239 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #240 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #241 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #242 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #243 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #244 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #245 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #246 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #247 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #248 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #249 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975

SUMMARY: AddressSanitizer: stack-overflow ../../../../src/libsanitizer/asan/asan_stack.cpp:63 in __sanitizer::BufferedStackTrace::UnwindImpl(unsigned long, unsigned long, void*, bool, unsigned int)
==26==ABORTING
```

```
USE_ZEND_ALLOC=0 php poc.php
```


### PHP Version

```plain
8.6.0
```

### Operating System

ubuntu 22.04
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.