From e0c17b3020a7c3dcbda1fdf763de5d457c202da3 Mon Sep 17 00:00:00 2001
From: lazerg <lazerg2@gmail.com>
Date: Thu, 6 Aug 2026 21:18:56 +0500
Subject: [PATCH] Fix GH-23088: Stack overflow when comparing deeply nested
 arrays

---
 NEWS                    |  4 ++++
 Zend/tests/gh23088.phpt | 40 ++++++++++++++++++++++++++++++++++++++++
 Zend/zend_operators.c   | 19 +++++++++++++++++--
 3 files changed, 61 insertions(+), 2 deletions(-)
 create mode 100644 Zend/tests/gh23088.phpt

diff --git a/NEWS b/NEWS
index 474db936ef15..8e6c57cb761a 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,10 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 8.4.25
 
+- Core:
+  . Fixed bug GH-23088 (Stack overflow when comparing deeply nested arrays).
+    (Lazizbek Ergashev)
+
 - Date:
   . Fixed leak on double DatePeriod::__construct() call. (ilutov)
 
diff --git a/Zend/tests/gh23088.phpt b/Zend/tests/gh23088.phpt
new file mode 100644
index 000000000000..17bcb091d018
--- /dev/null
+++ b/Zend/tests/gh23088.phpt
@@ -0,0 +1,40 @@
+--TEST--
+GH-23088 (Stack overflow when comparing deeply nested arrays)
+--SKIPIF--
+<?php
+if (ini_get('zend.max_allowed_stack_size') === false) {
+    die('skip No stack limit support');
+}
+if (getenv('SKIP_ASAN')) {
+    die('skip ASAN needs different stack limit setting due to more stack space usage');
+}
+?>
+--INI--
+zend.max_allowed_stack_size=256K
+--FILE--
+<?php
+
+$a = [];
+$b = [];
+
+for ($i = 0; $i < 20000; $i++) {
+    $a = [$a];
+    $b = [$b];
+}
+
+try {
+    var_dump($a == $b);
+} catch (Error $e) {
+    echo $e->getMessage(), PHP_EOL;
+}
+
+try {
+    var_dump($a === $b);
+} catch (Error $e) {
+    echo $e->getMessage(), PHP_EOL;
+}
+
+?>
+--EXPECT--
+Maximum call stack size reached during array comparison
+Maximum call stack size reached during array comparison
diff --git a/Zend/zend_operators.c b/Zend/zend_operators.c
index 0a7c335326e5..a0548b124847 100644
--- a/Zend/zend_operators.c
+++ b/Zend/zend_operators.c
@@ -2417,8 +2417,16 @@ ZEND_API bool ZEND_FASTCALL zend_is_identical(const zval *op1, const zval *op2)
 		case IS_STRING:
 			return zend_string_equals(Z_STR_P(op1), Z_STR_P(op2));
 		case IS_ARRAY:
-			return (Z_ARRVAL_P(op1) == Z_ARRVAL_P(op2) ||
-				zend_hash_compare(Z_ARRVAL_P(op1), Z_ARRVAL_P(op2), (compare_func_t) hash_zval_identical_function, 1) == 0);
+			if (Z_ARRVAL_P(op1) == Z_ARRVAL_P(op2)) {
+				return 1;
+			}
+#ifdef ZEND_CHECK_STACK_LIMIT
+			if (UNEXPECTED(zend_call_stack_overflowed(EG(stack_limit)))) {
+				zend_throw_error(NULL, "Maximum call stack size reached during array comparison");
+				return 0;
+			}
+#endif
+			return zend_hash_compare(Z_ARRVAL_P(op1), Z_ARRVAL_P(op2), (compare_func_t) hash_zval_identical_function, 1) == 0;
 		case IS_OBJECT:
 			return (Z_OBJ_P(op1) == Z_OBJ_P(op2));
 		default:
@@ -3423,6 +3431,13 @@ ZEND_API int ZEND_FASTCALL zend_compare_symbol_tables(HashTable *ht1, HashTable
 
 ZEND_API int ZEND_FASTCALL zend_compare_arrays(zval *a1, zval *a2) /* {{{ */
 {
+#ifdef ZEND_CHECK_STACK_LIMIT
+	if (UNEXPECTED(zend_call_stack_overflowed(EG(stack_limit)))) {
+		zend_throw_error(NULL, "Maximum call stack size reached during array comparison");
+		return ZEND_UNCOMPARABLE;
+	}
+#endif
+
 	return zend_compare_symbol_tables(Z_ARRVAL_P(a1), Z_ARRVAL_P(a2));
 }
 /* }}} */