Merge branch 'PHP-8.6'

* PHP-8.6:
  Fix stack overflow in filter_var() and filter_var_array() (#25349)

Author: LamentXU123

ext/filter/filter.c

@@ -421,6 +421,13 @@ static void php_zval_filter_recursive(zval *value, zend_long filter, zend_long f
 	if (Z_TYPE_P(value) == IS_ARRAY) {
 		zval *element;
 
+#ifdef ZEND_CHECK_STACK_LIMIT
+		if (UNEXPECTED(zend_call_stack_overflowed(EG(stack_limit)))) {
+			zend_call_stack_size_error();
+			return;
+		}
+#endif
+
 		if (Z_IS_RECURSIVE_P(value)) {
 			return;
 		}
@@ -431,6 +438,10 @@ static void php_zval_filter_recursive(zval *value, zend_long filter, zend_long f
 			if (Z_TYPE_P(element) == IS_ARRAY) {
 				SEPARATE_ARRAY(element);
 				php_zval_filter_recursive(element, filter, flags, options, charset);
+				if (EG(exception)) {
+					Z_UNPROTECT_RECURSION_P(value);
+					return;
+				}
 			} else {
 				php_zval_filter(element, filter, flags, options, charset);
 			}
@@ -658,6 +669,7 @@ static void php_filter_array_handler(zval *input, HashTable *op_ht, zend_long op
 					2
 				);
 				if (EG(exception)) {
+					zval_ptr_dtor(&nval);
 					RETURN_THROWS();
 				}
 				zend_hash_update(Z_ARRVAL_P(return_value), arg_key, &nval);

ext/filter/tests/filter_recursive_stack_limit.phpt

@@ -0,0 +1,47 @@
+--TEST--
+Stack overflow in filter_var() and filter_var_array() with deeply nested arrays
+--EXTENSIONS--
+filter
+--SKIPIF--
+<?php
+if (ini_get('zend.max_allowed_stack_size') === false) {
+    die('skip No stack limit support');
+}
+if (getenv('SKIP_ASAN')) {
+    die('skip ASAN needs different stack limit setting due to more stack space usage');
+}
+?>
+--INI--
+zend.max_allowed_stack_size=256K
+--FILE--
+<?php
+$deep = 'x';
+for ($i = 0; $i < 30000; $i++) {
+    $deep = [$deep];
+}
+
+/* Two top-level entries: the second must not be visited once the
+ * stack limit error has been thrown, so only one Error is thrown. */
+try {
+    filter_var([$deep, $deep], FILTER_DEFAULT, FILTER_REQUIRE_ARRAY);
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+    var_dump($e->getPrevious());
+}
+try {
+    filter_var_array(['a' => $deep, 'b' => $deep], ['a' => ['flags' => FILTER_REQUIRE_ARRAY], 'b' => ['flags' => FILTER_REQUIRE_ARRAY]]);
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+    var_dump($e->getPrevious());
+}
+
+unset($e);
+while (is_array($deep)) {
+    $deep = $deep[0];
+}
+?>
+--EXPECTF--
+Maximum call stack size of %d bytes (zend.max_allowed_stack_size - zend.reserved_stack_size) reached. Infinite recursion?
+NULL
+Maximum call stack size of %d bytes (zend.max_allowed_stack_size - zend.reserved_stack_size) reached. Infinite recursion?
+NULL