Merge branch 'PHP-8.4' into PHP-8.5

alexdowad · alexdowad · commit e106d688c282 · 2026-02-17T06:48:37.000+09:00
diff --git a/NEWS b/NEWS
@@ -28,6 +28,10 @@ PHP                                                                        NEWS
   . Fixed bug GH-21097 (Accessing Dom\Node properties can can throw TypeError).
     (ndossche)
 
+- MBString:
+  . Fixed bug GH-21223; mb_guess_encoding no longer crashes when passed huge
+    list of candidate encodings (with 200,000+ entries). (Jordi Kroon)
+
 - Opcache:
   . Fixed bug GH-20718 ("Insufficient shared memory" when using JIT on Solaris).
     (Petr Sumbera)
diff --git a/ext/mbstring/mbstring.c b/ext/mbstring/mbstring.c
@@ -3382,15 +3382,17 @@ MBSTRING_API const mbfl_encoding* mb_guess_encoding_for_strings(const unsigned c
 		return *elist;
 	}
 
-	/* Allocate on stack; when we return, this array is automatically freed */
-	struct candidate *array = alloca(elist_size * sizeof(struct candidate));
+	/* Allocate on stack or heap */
+	ALLOCA_FLAG(use_heap)
+	struct candidate *array = do_alloca(elist_size * sizeof(struct candidate), use_heap);
 	elist_size = init_candidate_array(array, elist_size, elist, strings, str_lengths, n, strict, order_significant);
 
 	while (n--) {
 		start_string(array, elist_size, strings[n], str_lengths[n]);
 		elist_size = count_demerits(array, elist_size, strict);
 		if (elist_size == 0) {
 			/* All candidates were eliminated */
+			free_alloca(array, use_heap);
 			return NULL;
 		}
 	}
@@ -3402,7 +3404,10 @@ MBSTRING_API const mbfl_encoding* mb_guess_encoding_for_strings(const unsigned c
 			best = i;
 		}
 	}
-	return array[best].enc;
+
+	const mbfl_encoding *result = array[best].enc;
+	free_alloca(array, use_heap);
+	return result;
 }
 
 /* When doing 'strict' detection, any string which is invalid in the candidate encoding
diff --git a/ext/mbstring/tests/gh21223.phpt b/ext/mbstring/tests/gh21223.phpt
@@ -0,0 +1,19 @@
+--TEST--
+GH-21223 (Stack overflow in mb_guess_encoding called via mb_detect_encoding)
+--EXTENSIONS--
+mbstring
+--FILE--
+<?php
+$str = "hello";
+
+$list = [];
+for ($i = 0; $i < 500000; $i++) {
+    $list[] = "UTF-8";
+}
+
+var_dump(mb_detect_encoding($str, $list, false));
+echo "Done";
+?>
+--EXPECT--
+string(5) "UTF-8"
+Done

Original file line number	Diff line number	Diff line change
`@@ -3382,15 +3382,17 @@ MBSTRING_API const mbfl_encoding* mb_guess_encoding_for_strings(const unsigned c`
`3382`	`3382`	`return *elist;`
`3383`	`3383`	`}`
`3384`	`3384`
`3385`		`- /* Allocate on stack; when we return, this array is automatically freed */`
`3386`		`- struct candidate array = alloca(elist_size sizeof(struct candidate));`
	`3385`	`+ /* Allocate on stack or heap */`
	`3386`	`+ ALLOCA_FLAG(use_heap)`
	`3387`	`+ struct candidate array = do_alloca(elist_size sizeof(struct candidate), use_heap);`
`3387`	`3388`	`elist_size = init_candidate_array(array, elist_size, elist, strings, str_lengths, n, strict, order_significant);`
`3388`	`3389`
`3389`	`3390`	`while (n--) {`
`3390`	`3391`	`start_string(array, elist_size, strings[n], str_lengths[n]);`
`3391`	`3392`	`elist_size = count_demerits(array, elist_size, strict);`
`3392`	`3393`	`if (elist_size == 0) {`
`3393`	`3394`	`/* All candidates were eliminated */`
	`3395`	`+ free_alloca(array, use_heap);`
`3394`	`3396`	`return NULL;`
`3395`	`3397`	`}`
`3396`	`3398`	`}`
`@@ -3402,7 +3404,10 @@ MBSTRING_API const mbfl_encoding* mb_guess_encoding_for_strings(const unsigned c`
`3402`	`3404`	`best = i;`
`3403`	`3405`	`}`
`3404`	`3406`	`}`
`3405`		`- return array[best].enc;`
	`3407`	`+`
	`3408`	`+ const mbfl_encoding *result = array[best].enc;`
	`3409`	`+ free_alloca(array, use_heap);`
	`3410`	`+ return result;`
`3406`	`3411`	`}`
`3407`	`3412`
`3408`	`3413`	`/* When doing 'strict' detection, any string which is invalid in the candidate encoding`