Repository navigation
Fix stack overflow in filter_var() and filter_var_array() - #25349
Open
eyupcanakman wants to merge 1 commit into
Open
eyupcanakman wants to merge 1 commit into
eyupcanakman wants to merge 1 commit into
Conversation
php_zval_filter_recursive() goes one C call deeper per nesting level without checking the stack limit, so deep enough input segfaults. Check the stack limit there, and stop the element and key loops once an exception is pending so a second deep entry does not chain another Error.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
filter_var()andfilter_var_array()walk array input withphp_zval_filter_recursive(), which goes one C call deeper per nesting level without checking the stack limit. On a Linux release build with an 8 MB stack, an array nested 100000 levels deep segfaults.The helper now checks the stack limit the same way the recursive functions in
ext/standarddo. Once an exception is pending, its loop over the array elements and the key loop inphp_filter_array_handler()stop, so a second deep entry does not throw again and chain another Error.Stopping the key loop matches PHP-8.5, which already returns there. One visible effect on 8.4 is that a later key's error no longer wraps an exception thrown by an earlier key's callback.
Deep enough arrays can still crash when they are freed (GH-15869), and on a Linux debug build that happens first.
No issue was filed for it.