From 32fb34e2d1640b50ede5b8a7915ae761605f7a3c Mon Sep 17 00:00:00 2001 From: Stanislav Malyshev Date: Fri, 2 Mar 2007 21:58:05 +0000 Subject: [PATCH] limit nesting level of input variables --- main/main.c | 1 + main/php_globals.h | 1 + main/php_variables.c | 6 ++++++ 3 files changed, 8 insertions(+) diff --git a/main/main.c b/main/main.c index abb27b86955ca..822c30e0cd76c 100644 --- a/main/main.c +++ b/main/main.c @@ -305,6 +305,7 @@ PHP_INI_BEGIN() STD_PHP_INI_ENTRY("upload_max_filesize", "2M", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateLong, upload_max_filesize, php_core_globals, core_globals) STD_PHP_INI_ENTRY("post_max_size", "8M", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateLong, post_max_size, sapi_globals_struct,sapi_globals) STD_PHP_INI_ENTRY("upload_tmp_dir", NULL, PHP_INI_SYSTEM, OnUpdateStringUnempty, upload_tmp_dir, php_core_globals, core_globals) + STD_PHP_INI_ENTRY("max_input_nesting_level", "64", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateLongGEZero, max_input_nesting_level, php_core_globals, core_globals) STD_PHP_INI_ENTRY("user_dir", NULL, PHP_INI_SYSTEM, OnUpdateString, user_dir, php_core_globals, core_globals) STD_PHP_INI_ENTRY("variables_order", "EGPCS", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateStringUnempty, variables_order, php_core_globals, core_globals) diff --git a/main/php_globals.h b/main/php_globals.h index d3e4f1784c9f3..84b20b1c1096a 100644 --- a/main/php_globals.h +++ b/main/php_globals.h @@ -155,6 +155,7 @@ struct _php_core_globals { #ifdef PHP_WIN32 zend_bool com_initialized; #endif + long max_input_nesting_level; }; diff --git a/main/php_variables.c b/main/php_variables.c index 9754b4f3478f3..32acb140e968d 100644 --- a/main/php_variables.c +++ b/main/php_variables.c @@ -119,10 +119,16 @@ PHPAPI void php_register_variable_ex(char *var, zval *val, zval *track_vars_arra index_len = var_len; if (is_array) { + int nest_level = 0; while (1) { char *index_s; int new_idx_len = 0; + if(++nest_level > PG(max_nesting_level)) { + /* too many levels of nesting */ + php_error_docref(NULL TSRMLS_CC, E_ERROR, "Input variable nesting level more than allowed %d (change max_input_nesting_level in php.ini to increase the limit)", PG(max_input_nesting_level)); + } + ip++; index_s = ip; if (isspace(*ip)) {