Skip to content

Fix stack overflow in filter_var() and filter_var_array() - #25349

Open
eyupcanakman wants to merge 1 commit into
php:PHP-8.4from
eyupcanakman:filter-recursive-stack-limit
Open

eyupcanakman wants to merge 1 commit into
php:PHP-8.4from
eyupcanakman:filter-recursive-stack-limit

Conversation

@eyupcanakman

Copy link
Copy Markdown
Contributor

filter_var() and filter_var_array() walk array input with php_zval_filter_recursive(), which goes one C call deeper per nesting level without checking the stack limit. On a Linux release build with an 8 MB stack, an array nested 100000 levels deep segfaults.

The helper now checks the stack limit the same way the recursive functions in ext/standard do. Once an exception is pending, its loop over the array elements and the key loop in php_filter_array_handler() stop, so a second deep entry does not throw again and chain another Error.

Stopping the key loop matches PHP-8.5, which already returns there. One visible effect on 8.4 is that a later key's error no longer wraps an exception thrown by an earlier key's callback.

Deep enough arrays can still crash when they are freed (GH-15869), and on a Linux debug build that happens first.

No issue was filed for it.

php_zval_filter_recursive() goes one C call deeper per nesting level without checking the stack limit, so deep enough input segfaults.
Check the stack limit there, and stop the element and key loops once an exception is pending so a second deep entry does not chain another Error.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant