stack overflow in array/sanitizer

Description

The following code:

<?php
$a=[]; for($i=0;$i<1000000;$i++){$a=['k'=>$a];}
$b=array_merge_recursive($a,$a);

Resulted in this output:

    #226 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #227 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #228 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #229 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #230 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #231 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #232 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #233 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #234 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #235 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #236 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #237 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #238 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #239 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #240 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #241 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #242 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #243 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #244 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #245 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #246 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #247 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #248 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #249 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975

SUMMARY: AddressSanitizer: stack-overflow ../../../../src/libsanitizer/asan/asan_stack.cpp:63 in __sanitizer::BufferedStackTrace::UnwindImpl(unsigned long, unsigned long, void*, bool, unsigned int)
==26==ABORTING

USE_ZEND_ALLOC=0 php poc.php

PHP Version

8.6.0

Operating System

ubuntu 22.04

Commencez par le reproducer de l’issue et inspectez php_array_merge_recursive dans ext/standard/array.c:3975. Exécutez-le avec AddressSanitizer et USE_ZEND_ALLOC=0, puis ajoutez un test de régression couvrant le cas imbriqué de array_merge_recursive ; le travail est terminé lorsque le reproducer ne provoque plus de débordement de pile.