diff options
| author | Rasmus Lerdorf <rasmus@php.net> | 2003-04-01 21:44:47 +0000 |
|---|---|---|
| committer | Rasmus Lerdorf <rasmus@php.net> | 2003-04-01 21:44:47 +0000 |
| commit | 7e8039ef0dd359ea7e7886f3f482a30f47fd8b6a (patch) | |
| tree | be7ac9227bf802c52fe054ecdfebd5700e66470b /ext | |
| parent | d1c0cc7f4760a3fbe8198a4e189389d0841bac32 (diff) | |
| download | php-git-7e8039ef0dd359ea7e7886f3f482a30f47fd8b6a.tar.gz | |
Arbitrarily limit array_pad() to only do 1 million elements at a time.
Probably still too high, but it solves the segfault for now.
Diffstat (limited to 'ext')
| -rw-r--r-- | ext/standard/array.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/ext/standard/array.c b/ext/standard/array.c index d58f1991db..afe4b64ab1 100644 --- a/ext/standard/array.c +++ b/ext/standard/array.c @@ -2339,6 +2339,10 @@ PHP_FUNCTION(array_pad) /* Populate the pads array */ num_pads = pad_size_abs - input_size; + if(num_pads > 1048576) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "You may only pad up to 1048576 elements at a time"); + RETURN_FALSE; + } pads = (zval ***)emalloc(num_pads * sizeof(zval **)); for (i = 0; i < num_pads; i++) pads[i] = pad_value; |