Skip to content

Fix GH-23115: stack overflow in compact() with deep arrays #23126

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
arnaud-lb merged 4 commits into from
Aug 10, 2026
Merged

Fix GH-23115: stack overflow in compact() with deep arrays #23126

Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
0d542e6
Fix GH-23115: stack overflow in compact() with deep arrays
lazerg Aug 8, 2026
6edb354
compact(): stop iterating once php_compact_var() has thrown
lazerg Aug 10, 2026
f9e124a
compact(): return zend_result from php_compact_var()
lazerg Aug 10, 2026
bf83cc1
Merge branch 'PHP-8.4' into fix/gh-23115-compact-stack-limit
arnaud-lb Aug 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
compact(): return zend_result from php_compact_var()
  • Loading branch information
@lazerg
lazerg committed Aug 10, 2026
commit f9e124a3e503eed4d7d58acc3a77c64b6841d373
24 changes: 16 additions & 8 deletions ext/standard/array.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2692,7 +2692,7 @@ PHP_FUNCTION(extract)
}
/* }}} */

static void php_compact_var(HashTable *eg_active_symbol_table, zval *return_value, zval *entry, uint32_t pos) /* {{{ */
static zend_result php_compact_var(HashTable *eg_active_symbol_table, zval *return_value, zval *entry, uint32_t pos) /* {{{ */
{
zval *value_ptr, data;

Expand All @@ -2710,34 +2710,43 @@ static void php_compact_var(HashTable *eg_active_symbol_table, zval *return_valu
}
} else {
php_error_docref_unchecked(NULL, E_WARNING, "Undefined variable $%S", Z_STR_P(entry));
/* A user error handler may have thrown. */
return EG(exception) ? FAILURE : SUCCESS;
}
} else if (Z_TYPE_P(entry) == IS_ARRAY) {
zend_result result = SUCCESS;

#ifdef ZEND_CHECK_STACK_LIMIT
if (UNEXPECTED(zend_call_stack_overflowed(EG(stack_limit)))) {
zend_call_stack_size_error();
return;
return FAILURE;
}
#endif
if (Z_REFCOUNTED_P(entry)) {
if (Z_IS_RECURSIVE_P(entry)) {
zend_throw_error(NULL, "Recursion detected");
return;
return FAILURE;
}
Z_PROTECT_RECURSION_P(entry);
}
ZEND_HASH_FOREACH_VAL(Z_ARRVAL_P(entry), value_ptr) {
php_compact_var(eg_active_symbol_table, return_value, value_ptr, pos);
if (UNEXPECTED(EG(exception))) {
if (UNEXPECTED(php_compact_var(eg_active_symbol_table, return_value, value_ptr, pos) == FAILURE)) {
result = FAILURE;
break;
}
} ZEND_HASH_FOREACH_END();
if (Z_REFCOUNTED_P(entry)) {
Z_UNPROTECT_RECURSION_P(entry);
}

return result;
} else {
php_error_docref(NULL, E_WARNING, "Argument #%d must be string or array of strings, %s given", pos, zend_zval_value_name(entry));
return;
/* A user error handler may have thrown. */
return EG(exception) ? FAILURE : SUCCESS;
}

return SUCCESS;
}
/* }}} */

Expand Down Expand Up @@ -2769,8 +2778,7 @@ PHP_FUNCTION(compact)
}

for (i = 0; i < num_args; i++) {
php_compact_var(symbol_table, return_value, &args[i], i + 1);
if (UNEXPECTED(EG(exception))) {
if (UNEXPECTED(php_compact_var(symbol_table, return_value, &args[i], i + 1) == FAILURE)) {
RETURN_THROWS();
}
}
Expand Down