Commit 90d2f8a

committed

Merge branch 'PHP-8.4'

2 parents 05618e7 + a788425 commit 90d2f8aCopy full SHA for 90d2f8a

File tree

+53

-0

lines changed

+53

-0

lines changed

Lines changed: 39 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,39 @@`
	`1`	`+--TEST--`
	`2`	`+GH-18572: Nested object comparison leading to stack overflow`
	`3`	`+--SKIPIF--`
	`4`	`+<?php`
	`5`	`+if (getenv('SKIP_ASAN')) die('skip as it fatally crash');`
	`6`	`+?>`
	`7`	`+--FILE--`
	`8`	`+<?php`
	`9`	`+`
	`10`	`+#[AllowDynamicProperties]`
	`11`	`+class Node {`
	`12`	`+ public $next;`
	`13`	`+ // forcing dynamic property creation is key`
	`14`	`+}`
	`15`	`+`
	`16`	`+$first = new Node();`
	`17`	`+$first->previous = $first;`
	`18`	`+$first->next = $first;`
	`19`	`+`
	`20`	`+$cur = $first;`
	`21`	`+`
	`22`	`+for ($i = 0; $i < 50000; $i++) {`
	`23`	`+ $new = new Node();`
	`24`	`+ $new->previous = $cur;`
	`25`	`+ $cur->next = $new;`
	`26`	`+ $new->next = $first;`
	`27`	`+ $first->previous = $new;`
	`28`	`+ $cur = $new;`
	`29`	`+}`
	`30`	`+`
	`31`	`+try {`
	`32`	`+ // Force comparison manually to trigger zend_hash_compare`
	`33`	`+ $first == $cur;`
	`34`	`+} catch(Error $e) {`
	`35`	`+ echo $e->getMessage(). PHP_EOL;`
	`36`	`+}`
	`37`	`+?>`
	`38`	`+--EXPECTREGEX--`
	`39`	`+(Maximum call stack size reached during object comparison\|Fatal error: Nesting level too deep - recursive dependency?.+)`

Lines changed: 14 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -46,6 +46,15 @@`
`46`	`46`	`#define IN_ISSET ZEND_GUARD_PROPERTY_ISSET`
`47`	`47`	`#define IN_HOOK ZEND_GUARD_PROPERTY_HOOK`
`48`	`48`
	`49`	`+static zend_always_inline bool zend_objects_check_stack_limit(void)`
	`50`	`+{`
	`51`	`+#ifdef ZEND_CHECK_STACK_LIMIT`
	`52`	`+ return zend_call_stack_overflowed(EG(stack_limit));`
	`53`	`+#else`
	`54`	`+ return false;`
	`55`	`+#endif`
	`56`	`+}`
	`57`	`+`
`49`	`58`	`/*`
`50`	`59`	`__X accessors explanation:`
`51`	`60`
`@@ -2122,6 +2131,11 @@ ZEND_API int zend_std_compare_objects(zval o1, zval o2) /* {{{ */`
`2122`	`2131`	`{`
`2123`	`2132`	`zend_object zobj1, zobj2;`
`2124`	`2133`
	`2134`	`+ if (zend_objects_check_stack_limit()) {`
	`2135`	`+ zend_throw_error(NULL, "Maximum call stack size reached during object comparison");`
	`2136`	`+ return ZEND_UNCOMPARABLE;`
	`2137`	`+ }`
	`2138`	`+`
`2125`	`2139`	`if (Z_TYPE_P(o1) != Z_TYPE_P(o2)) {`
`2126`	`2140`	`/* Object and non-object */`
`2127`	`2141`	`zval *object;`

Comments

(0)