archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

limit nesting level of input variables

Browse source
This commit is contained in:
Stanislav Malyshev 2007-03-02 21:58:05 +00:00
parent f1d075a102
commit 32fb34e2d1
3 changed files with 8 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
main/main.c
View file

@ -305,6 +305,7 @@ PHP_INI_BEGIN()
STD_PHP_INI_ENTRY("upload_max_filesize", "2M", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateLong, upload_max_filesize, php_core_globals, core_globals)
STD_PHP_INI_ENTRY("post_max_size", "8M", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateLong, post_max_size, sapi_globals_struct,sapi_globals)
STD_PHP_INI_ENTRY("upload_tmp_dir", NULL, PHP_INI_SYSTEM, OnUpdateStringUnempty, upload_tmp_dir, php_core_globals, core_globals)
STD_PHP_INI_ENTRY("max_input_nesting_level", "64", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateLongGEZero, max_input_nesting_level, php_core_globals, core_globals)
STD_PHP_INI_ENTRY("user_dir", NULL, PHP_INI_SYSTEM, OnUpdateString, user_dir, php_core_globals, core_globals)
STD_PHP_INI_ENTRY("variables_order", "EGPCS", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateStringUnempty, variables_order, php_core_globals, core_globals)

1
main/php_globals.h
View file

@ -155,6 +155,7 @@ struct _php_core_globals {
#ifdef PHP_WIN32
zend_bool com_initialized;
#endif
long max_input_nesting_level;
};

6
main/php_variables.c
View file

@ -119,10 +119,16 @@ PHPAPI void php_register_variable_ex(char *var, zval *val, zval *track_vars_arra
index_len = var_len;
if (is_array) {
int nest_level = 0;
while (1) {
char *index_s;
int new_idx_len = 0;
if(++nest_level > PG(max_nesting_level)) {
/* too many levels of nesting */
php_error_docref(NULL TSRMLS_CC, E_ERROR, "Input variable nesting level more than allowed %d (change max_input_nesting_level in php.ini to increase the limit)", PG(max_input_nesting_level));
}
ip++;
index_s = ip;
if (isspace(*ip)) {