Fixed bug #43482 (array_pad() does not warn on very small pad numbers).

diff --git a/NEWS b/NEWS
index 1a87ce1a8d1807060171ec363c92237deeebcab3..a6ada1d8240981cf21324461d0476d1b7d9a5ba2 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,8 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2008, PHP 5.2.6
+- Fixed bug #43482 (array_pad() does not warn on very small pad numbers).
+  (Ilia)
 - Fixed bug #43457 (Prepared statement with incorrect parms doens't
   throw exception with pdo_pgsql driver). (Ilia)
 - Fixed bug #43386 (array_globals not reset to 0 properly on init). (Ilia)

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 9ebb8f1c2976f44cf95b564476f7f797d82c909e..adaefeb0ca1e322d9c4ef527d182ceb6c8fe747f 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -2655,6 +2655,11 @@ PHP_FUNCTION(array_pad)
        /* Do some initial calculations */
        input_size = zend_hash_num_elements(Z_ARRVAL_PP(input));
        pad_size_abs = abs(Z_LVAL_PP(pad_size));
+       if (pad_size_abs < 0) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "You may only pad up to 1048576 elements at a time");
+               zval_dtor(return_value);
+               RETURN_FALSE;
+       }
        do_pad = (input_size >= pad_size_abs) ? 0 : 1;
        
        /* Copy the original array */