stack overflow in array/asan

[djarfluka]

Description

The following code:

<?php
$a=[]; for($i=0;$i<1000000;$i++){ $a=['k'=>$a]; }
$b=array_replace_recursive($a,$a);

Resulted in this output:

 #222 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #223 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #224 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #225 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #226 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #227 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #228 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #229 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #230 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #231 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #232 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #233 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #234 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #235 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #236 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #237 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #238 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #239 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #240 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #241 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #242 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #243 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #244 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #245 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #246 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #247 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096
    #248 0x5605968edbd8 in php_array_replace_recursive /home/php-src/ext/standard/array.c:4096

SUMMARY: AddressSanitizer: stack-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_allocator_combined.h:44 in __sanitizer::CombinedAllocator<__sanitizer::SizeClassAllocator64<__asan::AP64<__sanitizer::LocalAddressSpaceView> >, __sanitizer::LargeMmapAllocatorPtrArrayDynamic>::Allocate(__sanitizer::SizeClassAllocator64LocalCache<__sanitizer::SizeClassAllocator64<__asan::AP64<__sanitizer::LocalAddressSpaceView> > >*, unsigned long, unsigned long)
==30==ABORTING

USE_ZEND_ALLOC=0 php poc.php

PHP Version

8.6.0

Operating System

ubuntu 22.04