GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Fix GH-23089: stack overflow in array_merge_recursive() by akasakariko · Pull Request #25406 · php/php-src

Conversation

@akasakariko

@akasakariko akasakariko commented Nov 12, 2026

Copy link
Copy Markdown

Fixes #23089

Check the Zend stack limit in array_merge_recursive() so deeply nested merges throw an Error before exhausting the native stack, using the same guard as array_replace_recursive()

Continues #23091, which was closed without merging; the object cleanup raised in that review is already present through #23340

The original input still encounters the independent array destruction overflow in #15869 during shutdown after reporting the Error, which also reproduces with the merge call removed

The regression frees its input iteratively to isolate recursive merging and runs under AddressSanitizer

Validation on macOS arm64

  • Debug NTS Standard and Zend suite: 8296 passed, 631 skipped, 1 expected failure
  • Debug ZTS with AddressSanitizer array tests and the next index overflow regression: 840 passed, 14 skipped
  • Original input with iterative cleanup and tracing JIT: catches Error and exits normally in both builds
  • Additional ASan stack checks: existing stack_limit_002 and stack_limit_004 Fiber failures reproduced on the unmodified baseline

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
@akasakariko
Fix phpGH-23089: stack overflow in array_merge_recursive()
fec7950
Check the Zend stack limit before descending into nested arrays
Add a regression test with iterative input cleanup to isolate the merge
failure from the separate array destruction overflow under AddressSanitizer

Continues the stack guard proposed in phpGH-23091
@akasakariko
akasakariko requested a review from bukka as a code owner November 12, 2026 03:39
@github-actions github-actions Bot added the Extension: standard label Nov 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bukka bukka Awaiting requested review from bukka bukka is a code owner

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

Extension: standard

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

1 participant

@akasakariko
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.