stack overflow in array/sanitizer

从 issue 中的 reproducer 开始，检查 ext/standard/array.c:3975 处的 php_array_merge_recursive。使用 AddressSanitizer 和 USE_ZEND_ALLOC=0 运行它，然后添加一个覆盖嵌套 array_merge_recursive 情况的回归测试；当 reproducer 不再导致栈溢出时即表示完成。

Description

The following code:

<?php
$a=[]; for($i=0;$i<1000000;$i++){$a=['k'=>$a];}
$b=array_merge_recursive($a,$a);

Resulted in this output:

    #226 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #227 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #228 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #229 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #230 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #231 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #232 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #233 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #234 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #235 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #236 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #237 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #238 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #239 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #240 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #241 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #242 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #243 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #244 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #245 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #246 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #247 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #248 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975
    #249 0x55fe77cec009 in php_array_merge_recursive /home/php-src/ext/standard/array.c:3975

SUMMARY: AddressSanitizer: stack-overflow ../../../../src/libsanitizer/asan/asan_stack.cpp:63 in __sanitizer::BufferedStackTrace::UnwindImpl(unsigned long, unsigned long, void*, bool, unsigned int)
==26==ABORTING

USE_ZEND_ALLOC=0 php poc.php

PHP Version

8.6.0

Operating System

ubuntu 22.04