php-5.2.17-max-input-vars.patch

   1 diff -u -r php-5.2.17/main/main.c php-5.2.17-patched/main/main.c
   2 --- php-5.2.17/main/main.c      2010-06-20 04:47:24.000000000 +0800
   3 +++ php-5.2.17-patched/main/main.c      2011-12-31 09:59:05.000000000 +0800
   4 @@ -457,6 +457,7 @@
   5
   6         STD_PHP_INI_BOOLEAN("allow_url_fopen",          "1",            PHP_INI_SYSTEM,         OnUpdateBool,           allow_url_fopen,                php_core_globals,       core_globals)
   7         STD_PHP_INI_BOOLEAN("allow_url_include",        "0",            PHP_INI_SYSTEM,         OnUpdateBool,           allow_url_include,              php_core_globals,       core_globals)
   8 +       STD_PHP_INI_ENTRY("max_input_vars",         "1000",     PHP_INI_SYSTEM|PHP_INI_PERDIR,      OnUpdateLongGEZero, max_input_vars, php_core_globals, core_globals)
   9         STD_PHP_INI_BOOLEAN("always_populate_raw_post_data",    "0",    PHP_INI_SYSTEM|PHP_INI_PERDIR,  OnUpdateBool,   always_populate_raw_post_data,  php_core_globals,       core_globals)
  10
  11         STD_PHP_INI_ENTRY("realpath_cache_size",        "16K",          PHP_INI_SYSTEM,         OnUpdateLong,   realpath_cache_size_limit,      virtual_cwd_globals,    cwd_globals)
  12 diff -u -r php-5.2.17/main/php_globals.h php-5.2.17-patched/main/php_globals.h
  13 --- php-5.2.17/main/php_globals.h       2010-01-03 17:23:27.000000000 +0800
  14 +++ php-5.2.17-patched/main/php_globals.h       2011-12-31 09:59:05.000000000 +0800
  15 @@ -160,6 +160,7 @@
  16         zend_bool com_initialized;
  17  #endif
  18         long max_input_nesting_level;
  19 +       long max_input_vars;
  20         zend_bool in_user_include;
  21         zend_bool in_error_log;
  22  };
  23 diff -u -r php-5.2.17/main/php_variables.c php-5.2.17-patched/main/php_variables.c
  24 --- php-5.2.17/main/php_variables.c     2010-01-03 17:23:27.000000000 +0800
  25 +++ php-5.2.17-patched/main/php_variables.c     2011-12-31 09:59:05.000000000 +0800
  26 @@ -187,6 +187,9 @@
  27                                 }
  28                                 if (zend_symtable_find(symtable1, escaped_index, index_len + 1, (void **) &gpc_element_p) == FAILURE
  29                                         || Z_TYPE_PP(gpc_element_p) != IS_ARRAY) {
  30 +                                       if (zend_hash_num_elements(symtable1) >= PG(max_input_vars)) {
  31 +                                               php_error_docref(NULL TSRMLS_CC, E_ERROR, "Input variables exceeded %ld. To increase the limit change max_input_vars in php.ini.", PG(max_input_vars));
  32 +                                       }
  33                                         MAKE_STD_ZVAL(gpc_element);
  34                                         array_init(gpc_element);
  35                                         zend_symtable_update(symtable1, escaped_index, index_len + 1, &gpc_element, sizeof(zval *), (void **) &gpc_element_p);
  36 @@ -232,6 +235,9 @@
  37                                 zend_symtable_exists(symtable1, escaped_index, index_len + 1)) {
  38                                 zval_ptr_dtor(&gpc_element);
  39                         } else {
  40 +                               if (zend_hash_num_elements(symtable1) >= PG(max_input_vars)) {
  41 +                                       php_error_docref(NULL TSRMLS_CC, E_ERROR, "Input variables exceeded %ld. To increase the limit change max_input_vars in php.ini.", PG(max_input_vars));
  42 +                               }
  43                                 zend_symtable_update(symtable1, escaped_index, index_len + 1, &gpc_element, sizeof(zval *), (void **) &gpc_element_p);
  44                         }
  45                         if (escaped_index != index) {