BomboBombone.exe XenForo’s guest editor includes an endpoint that converts BBCode to HTML. I sent it 5,000 nested quote tags—about 75 KB of text—and the PHP worker exited with Windows status 0xC00000FD, the stack-overflow exception.
Apache started a replacement worker. Several requests in parallel could consume the available pool until those workers were replaced.
Depth before length
The parser had a maximum-depth setting. Opening tags accumulated recursively before that setting was enforced. XenForo’s normal message-length validation also ran after the parser had built and walked the nested structure.
A shortened payload looks like this:
[quote][quote][quote]...[/quote][/quote][/quote]The worker crash was visible in the web-server log and process list. The request ended, Apache recorded the exit code, and a replacement worker appeared.
The public PoC builds the nested input and caps the requested depth at 5,000.
XenForo moved the effective limit ahead of the unsafe recursion in 2.3.13.