[2007-12-04 11:25 UTC] nicholsr@php.net

Description:
------------
This is basically the same as bug 42752 but in the array_merge_recursive rather than the array_walk recursive code. The fix is the same.

The detection of recursion used in array_merge_recursive is incorrect so it is possible to pass recursive arrays that cause unbounded recursion, leading to stack overflow.

Reproduce code:
---------------
<?php

$a=array("key1"=>array("key2"=>array()));
$a["key1"]["key2"]["key3"]=&$a;

$b=array("key1"=>array("key2"=>array()));
$b["key1"]["key2"]["key3"]=&$b;

array_merge_recursive ($a,$b);
echo "reached the end \n";

?>

Expected result:
----------------
reached the end

Actual result:
--------------
crash

 [2007-12-05 20:04 UTC] iliaa@php.net

This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.