diff options
| -rw-r--r-- | main/main.c | 1 | ||||
| -rw-r--r-- | main/php_globals.h | 1 | ||||
| -rw-r--r-- | main/php_variables.c | 6 |
3 files changed, 8 insertions, 0 deletions
diff --git a/main/main.c b/main/main.c index abb27b8695..822c30e0cd 100644 --- a/main/main.c +++ b/main/main.c @@ -305,6 +305,7 @@ PHP_INI_BEGIN() STD_PHP_INI_ENTRY("upload_max_filesize", "2M", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateLong, upload_max_filesize, php_core_globals, core_globals) STD_PHP_INI_ENTRY("post_max_size", "8M", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateLong, post_max_size, sapi_globals_struct,sapi_globals) STD_PHP_INI_ENTRY("upload_tmp_dir", NULL, PHP_INI_SYSTEM, OnUpdateStringUnempty, upload_tmp_dir, php_core_globals, core_globals) + STD_PHP_INI_ENTRY("max_input_nesting_level", "64", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateLongGEZero, max_input_nesting_level, php_core_globals, core_globals) STD_PHP_INI_ENTRY("user_dir", NULL, PHP_INI_SYSTEM, OnUpdateString, user_dir, php_core_globals, core_globals) STD_PHP_INI_ENTRY("variables_order", "EGPCS", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateStringUnempty, variables_order, php_core_globals, core_globals) diff --git a/main/php_globals.h b/main/php_globals.h index d3e4f1784c..84b20b1c10 100644 --- a/main/php_globals.h +++ b/main/php_globals.h @@ -155,6 +155,7 @@ struct _php_core_globals { #ifdef PHP_WIN32 zend_bool com_initialized; #endif + long max_input_nesting_level; }; diff --git a/main/php_variables.c b/main/php_variables.c index 9754b4f347..32acb140e9 100644 --- a/main/php_variables.c +++ b/main/php_variables.c @@ -119,10 +119,16 @@ PHPAPI void php_register_variable_ex(char *var, zval *val, zval *track_vars_arra index_len = var_len; if (is_array) { + int nest_level = 0; while (1) { char *index_s; int new_idx_len = 0; + if(++nest_level > PG(max_nesting_level)) { + /* too many levels of nesting */ + php_error_docref(NULL TSRMLS_CC, E_ERROR, "Input variable nesting level more than allowed %d (change max_input_nesting_level in php.ini to increase the limit)", PG(max_input_nesting_level)); + } + ip++; index_s = ip; if (isspace(*ip)) { |