diff --git a/NEWS b/NEWS index fc4f5d3d297..cc216648152 100644 --- a/NEWS +++ b/NEWS @@ -13,6 +13,8 @@ PHP NEWS - Standard: . Fixed bug #74357 (lchown fails to change ownership of symlink with ZTS) (Jakub Zelenka) + . Fixed bug GH-20843 (var_dump() crash with nested objects) + (David Carlier) 15 Jan 2026, PHP 8.4.17 diff --git a/ext/standard/tests/general_functions/gh20840.phpt b/ext/standard/tests/general_functions/gh20840.phpt new file mode 100644 index 00000000000..839b4728be1 --- /dev/null +++ b/ext/standard/tests/general_functions/gh20840.phpt @@ -0,0 +1,38 @@ +--TEST-- +GH-20840 (var_dump() crash with nested objects) +--CREDITS-- +bendrissou +--SKIPIF-- + +--INI-- +zend.max_allowed_stack_size=512K +--FILE-- +next = $newNode; + $node = $newNode; +} + +var_dump($firstNode); + +while ($next = $firstNode->next) { + $firstNode->next = $next->next; +} +?> +--EXPECTREGEX-- +^object\(Node\)#\d+ \(\d+\).*(nesting level too deep|["\s}]*)$ diff --git a/ext/standard/var.c b/ext/standard/var.c index df262eb520c..acb605d2eab 100644 --- a/ext/standard/var.c +++ b/ext/standard/var.c @@ -56,6 +56,12 @@ static void php_object_property_dump(zend_property_info *prop_info, zval *zv, ze { const char *prop_name, *class_name; +#ifdef ZEND_CHECK_STACK_LIMIT + if (UNEXPECTED(zend_call_stack_overflowed(EG(stack_limit)))) { + php_printf("%*cnesting level too deep", level + 1, ' '); + return; + } +#endif if (key == NULL) { /* numeric key */ php_printf("%*c[" ZEND_LONG_FMT "]=>\n", level + 1, ' ', index); } else { /* string key */