Introduced a max_file_uploads INI setting, which is set to limit the

number of file uploads per-request to 100 by default, to prevent possible
DOS via temporary file exhaustion.

diff --git a/main/main.c b/main/main.c
index 14c6559cb756562963222a2fee9f11df89974510..ac5a502a19404ebe4d0e28d24333e21454eebc93 100644 (file)
--- a/main/main.c
+++ b/main/main.c
@@ -602,6 +602,7 @@ PHP_INI_BEGIN()
        PHP_INI_ENTRY("mail.force_extra_parameters",NULL,               PHP_INI_SYSTEM|PHP_INI_PERDIR,          OnChangeMailForceExtra)
        PHP_INI_ENTRY("disable_functions",                      "",                     PHP_INI_SYSTEM,         NULL)
        PHP_INI_ENTRY("disable_classes",                        "",                     PHP_INI_SYSTEM,         NULL)
+       PHP_INI_ENTRY("max_file_uploads",                       "100",                  PHP_INI_SYSTEM,         NULL)
 
        STD_PHP_INI_BOOLEAN("allow_url_fopen",          "1",            PHP_INI_ALL,            OnUpdateAllowUrl,       allow_url_fopen_list,   php_core_globals,       core_globals)
        STD_PHP_INI_BOOLEAN("allow_url_include",        "0",            PHP_INI_ALL,            OnUpdateAllowUrl,       allow_url_include_list, php_core_globals,       core_globals)

diff --git a/main/rfc1867.c b/main/rfc1867.c
index 242125a066b2d1eebfc4eba9e788d96291a04a27..fbc3a2e818a1cc46ce2fd0b004845459e9c90774 100644 (file)
--- a/main/rfc1867.c
+++ b/main/rfc1867.c
@@ -594,6 +594,12 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler)
        zend_llist header;
        void *event_extra_data = NULL;
        int llen = 0;
+       char *max_uploads = INI_STR("max_file_uploads");
+       int upload_cnt = 0;
+
+       if (max_uploads && *max_uploads) {
+               upload_cnt = atoi(max_uploads);
+       }
 
        if (SG(request_info).content_length > SG(post_max_size)) {
                sapi_module.sapi_error(E_WARNING, "POST Content-Length of %ld bytes exceeds the limit of %ld bytes", SG(request_info).content_length, SG(post_max_size));
@@ -740,6 +746,9 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler)
                        /* If file_uploads=off, skip the file part */
                        if (!PG(file_uploads)) {
                                skip_upload = 1;
+                       } else if (upload_cnt <= 0) {
+                               skip_upload = 1;
+                               sapi_module.sapi_error(E_WARNING, "Maximum number of allowable file uploads has been exceeded");
                        }
 
                        /* Return with an error if the posted data is garbled */
@@ -784,6 +793,7 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler)
                        if (!skip_upload) {
                                /* Handle file */
                                fd = php_open_temporary_fd(PG(upload_tmp_dir), "php", &temp_filename TSRMLS_CC);
+                               upload_cnt--;
                                if (fd==-1) {
                                        sapi_module.sapi_error(E_WARNING, "File upload error - unable to create a temporary file");
                                        cancel_upload = UPLOAD_ERROR_E;

diff --git a/php.ini-development b/php.ini-development
index cb994bdf116868ae56134ebbb785e79e0785cf8d..a45b67042d8d7530f31691170dbd81e20f3823ff 100644 (file)
--- a/php.ini-development
+++ b/php.ini-development
@@ -878,6 +878,9 @@ file_uploads = On
 ; http://php.net/upload-max-filesize
 upload_max_filesize = 2M
 
+; Maximum number of files that can be uploaded via a single request
+max_file_uploads = 100
+
 ;;;;;;;;;;;;;;;;;;
 ; Fopen wrappers ;
 ;;;;;;;;;;;;;;;;;;

diff --git a/php.ini-production b/php.ini-production
index 3ef0957d75ee38153826f8390975af831f1abb58..9104155c8851a173132ed5865f282ddab3c2938b 100644 (file)
--- a/php.ini-production
+++ b/php.ini-production
@@ -878,6 +878,9 @@ file_uploads = On
 ; http://php.net/upload-max-filesize
 upload_max_filesize = 2M
 
+; Maximum number of files that can be uploaded via a single request
+max_file_uploads = 100
+
 ;;;;;;;;;;;;;;;;;;
 ; Fopen wrappers ;
 ;;;;;;;;;;;;;;;;;;