MFB

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 1815f0c30e7d0c1c8a8631edd7de0b3a86bab853..58b5349bab881b42a718166571ece9ff3210068d 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -2465,6 +2465,10 @@ PHP_FUNCTION(array_pad)
 
        /* Populate the pads array */
        num_pads = pad_size_abs - input_size;
+       if(num_pads > 1048576) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "You may only pad up to 1048576 elements at a time");
+               RETURN_FALSE;
+       }
        pads = (zval ***)emalloc(num_pads * sizeof(zval **));
        for (i = 0; i < num_pads; i++) {
                pads[i] = pad_value;