php-5.2.17-bug-323007-2.patch

   1 diff -up php-5.2.17/main/php_variables.c.bug-323007 php-5.2.17/main/php_variables.c
   2 --- php-5.2.17/main/php_variables.c.bug-323007  2012-02-03 12:12:09.000000000 +0700
   3 +++ php-5.2.17/main/php_variables.c     2012-02-03 13:17:16.000000000 +0700
   4 @@ -187,12 +187,17 @@ PHPAPI void php_register_variable_ex(cha
   5                                 }
   6                                 if (zend_symtable_find(symtable1, escaped_index, index_len + 1, (void **) &gpc_element_p) == FAILURE
   7                                         || Z_TYPE_PP(gpc_element_p) != IS_ARRAY) {
   8 -                                       if (zend_hash_num_elements(symtable1) >= PG(max_input_vars)) {
   9 -                                               php_error_docref(NULL TSRMLS_CC, E_ERROR, "Input variables exceeded %ld. To increase the limit change max_input_vars in php.ini.", PG(max_input_vars));
  10 -                                       }
  11 +                                       if (zend_hash_num_elements(symtable1) <= PG(max_input_vars)) {
  12 +                                           if (zend_hash_num_elements(symtable1) == PG(max_input_vars)) {
  13 +                                               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Input variables exceeded %ld. To increase the limit change max_input_vars in php.ini.", PG(max_input_vars));
  14 +                                           }
  15                                         MAKE_STD_ZVAL(gpc_element);
  16                                         array_init(gpc_element);
  17                                         zend_symtable_update(symtable1, escaped_index, index_len + 1, &gpc_element, sizeof(zval *), (void **) &gpc_element_p);
  18 +                                       } else {
  19 +                                   efree(var_orig);
  20 +                                   return;
  21 +                                       }
  22                                 }
  23                                 if (index != escaped_index) {
  24                                         efree(escaped_index);