[php-src] Issue #23113: stack overflow in array/asan

[email protected] (djarfluka)
Newsgroups php.bugs
Message-ID <[email protected]>
Issue: https://github.com/php/php-src/issues/23113
Author: djarfluka

### Description

The following code:

```php
<?php
$a=[]; for($i=0;$i<1000000;$i++){ $a=['k'=>$a]; }
$b=array_replace_recursive($a,$a);
```

Resulted in this output:
```
 #222 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #223 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #224 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #225 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #226 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #227 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #228 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #229 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #230 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #231 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #232 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #233 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #234 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #235 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #236 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #237 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #238 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #239 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #240 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #241 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #242 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #243 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #244 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #245 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #246 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #247 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #248 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096

SUMMARY: AddressSanitizer: stack-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_allocator_combined.h:44 in __sanitizer::CombinedAllocator<__sanitizer::SizeClassAllocator64<__asan::AP64<__sanitizer::LocalAddressSpaceView> >, __sanitizer::LargeMmapAllocatorPtrArrayDynamic>::Allocate(__sanitizer::SizeClassAllocator64LocalCache<__sanitizer::SizeClassAllocator64<__asan::AP64<__sanitizer::LocalAddressSpaceView> > >*, unsigned long, unsigned long)
==30==ABORTING
```

```
USE_ZEND_ALLOC=0 php poc.php
```


### PHP Version

```plain
8.6.0
```

### Operating System

ubuntu 22.04
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.