limit nesting level of input variables

diff --git a/main/main.c b/main/main.c
index abb27b86955ca6a7e9fea4a9e6aa32ebae61b244..822c30e0cd76cca6592f0998c10726f2a810f67f 100644 (file)
--- a/main/main.c
+++ b/main/main.c
@@ -305,6 +305,7 @@ PHP_INI_BEGIN()
        STD_PHP_INI_ENTRY("upload_max_filesize",        "2M",           PHP_INI_SYSTEM|PHP_INI_PERDIR,          OnUpdateLong,                   upload_max_filesize,    php_core_globals,       core_globals)
        STD_PHP_INI_ENTRY("post_max_size",                      "8M",           PHP_INI_SYSTEM|PHP_INI_PERDIR,          OnUpdateLong,                   post_max_size,                  sapi_globals_struct,sapi_globals)
        STD_PHP_INI_ENTRY("upload_tmp_dir",                     NULL,           PHP_INI_SYSTEM,         OnUpdateStringUnempty,  upload_tmp_dir,                 php_core_globals,       core_globals)
+       STD_PHP_INI_ENTRY("max_input_nesting_level", "64",              PHP_INI_SYSTEM|PHP_INI_PERDIR,          OnUpdateLongGEZero,     max_input_nesting_level,                        php_core_globals,       core_globals)
 
        STD_PHP_INI_ENTRY("user_dir",                           NULL,           PHP_INI_SYSTEM,         OnUpdateString,                 user_dir,                               php_core_globals,       core_globals)
        STD_PHP_INI_ENTRY("variables_order",            "EGPCS",        PHP_INI_SYSTEM|PHP_INI_PERDIR,          OnUpdateStringUnempty,  variables_order,                php_core_globals,       core_globals)

diff --git a/main/php_globals.h b/main/php_globals.h
index d3e4f1784c9f360b1ba35a7da77ba81bfc7cf22b..84b20b1c1096a5d42d85961bf0cd060c2a85fe01 100644 (file)
--- a/main/php_globals.h
+++ b/main/php_globals.h
@@ -155,6 +155,7 @@ struct _php_core_globals {
 #ifdef PHP_WIN32
        zend_bool com_initialized;
 #endif
+       long max_input_nesting_level;
 };
 
 

diff --git a/main/php_variables.c b/main/php_variables.c
index 9754b4f3478f30421421321f7956bffbeccc4c8f..32acb140e968d2a61757bab7684b1b3b6470b29f 100644 (file)
--- a/main/php_variables.c
+++ b/main/php_variables.c
@@ -119,10 +119,16 @@ PHPAPI void php_register_variable_ex(char *var, zval *val, zval *track_vars_arra
        index_len = var_len;
 
        if (is_array) {
+               int nest_level = 0;
                while (1) {
                        char *index_s;
                        int new_idx_len = 0;
 
+                       if(++nest_level > PG(max_nesting_level)) {
+                               /* too many levels of nesting */
+                               php_error_docref(NULL TSRMLS_CC, E_ERROR, "Input variable nesting level more than allowed %d (change max_input_nesting_level in php.ini to increase the limit)", PG(max_input_nesting_level));
+                       }
+
                        ip++;
                        index_s = ip;
                        if (isspace(*ip)) {