Commit 0593cf066e7 for php

commit 0593cf066e7121bfe01a1a10b60008bd619c79bd
Merge: db8c80bdb1a fa8a9d1ca99
Author: Weilin Du <weilindu@php.net>
Date:   Thu Nov 12 16:15:27 2026 +0800

    Merge branch 'PHP-8.4' into PHP-8.5

    * PHP-8.4:
      Fix stack overflow in filter_var() and filter_var_array() (#25349)

diff --cc NEWS
index f35834e6d77,e8051495b75..199282884a7
--- a/NEWS
+++ b/NEWS
@@@ -37,6 -37,18 +37,10 @@@ PH
    . Fixed bug GH-25306 (Assertion status == LXB_STATUS_OK in dom_parse_selector
      when lexbor allocation fails). (ndossche)

 -- GD:
 -  . Fixed use-after-free when drawing with a brush or tile image that was
 -    released after imagesetbrush() or imagesettile(). (lacatoire)
 -  . Fixed the argument blamed by the imagepolygon(), imageopenpolygon() and
 -    imagefilledpolygon() too few points error. (lacatoire)
 -
+ - Filter:
+   . Fixed stack overflow in filter_var() and filter_var_array() with deeply
+     nested arrays. (Eyüp Can Akman)
+
  - MBString:
    . Fixed stack overflow in mb_check_encoding() and mb_convert_encoding() with
      deeply nested arrays. (Eyüp Can Akman)
diff --cc ext/filter/filter.c
index c0682037c8c,a98fc56df24..cd021390f26
--- a/ext/filter/filter.c
+++ b/ext/filter/filter.c
@@@ -433,9 -409,13 +440,13 @@@ static void php_zval_filter_recursive(z
  			ZVAL_DEREF(element);
  			if (Z_TYPE_P(element) == IS_ARRAY) {
  				SEPARATE_ARRAY(element);
 -				php_zval_filter_recursive(element, filter, flags, options, charset, copy);
 +				php_zval_filter_recursive(element, filter, flags, options, charset);
+ 				if (EG(exception)) {
+ 					Z_UNPROTECT_RECURSION_P(value);
+ 					return;
+ 				}
  			} else {
 -				php_zval_filter(element, filter, flags, options, charset, copy);
 +				php_zval_filter(element, filter, flags, options, charset);
  			}
  		} ZEND_HASH_FOREACH_END();
  		Z_UNPROTECT_RECURSION_P(value);
@@@ -661,10 -599,10 +672,11 @@@ static void php_filter_array_handler(zv
  				php_filter_call(&nval, -1,
  					Z_TYPE_P(arg_elm) == IS_ARRAY ? Z_ARRVAL_P(arg_elm) : NULL,
  					Z_TYPE_P(arg_elm) == IS_ARRAY ? 0 : zval_get_long(arg_elm),
 -					0, FILTER_REQUIRE_SCALAR
 +					FILTER_REQUIRE_SCALAR,
 +					2
  				);
  				if (EG(exception)) {
+ 					zval_ptr_dtor(&nval);
  					RETURN_THROWS();
  				}
  				zend_hash_update(Z_ARRVAL_P(return_value), arg_key, &nval);