MFB: Fixed bug #43482 (array_pad() does not warn on very small pad

numbers).

diff --git a/ext/standard/array.c b/ext/standard/array.c
index eec7a87beb3bd57f3f2338dd2daf088116230406..48be4e84e1755216445fa2b29ce660ee2643e3a3 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -2684,6 +2684,11 @@ PHP_FUNCTION(array_pad)
        /* Do some initial calculations */
        input_size = zend_hash_num_elements(Z_ARRVAL_P(input));
        pad_size_abs = abs(pad_size);
+       if (pad_size_abs < 0) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "You may only pad up to 1048576 elements at a time");
+               zval_dtor(return_value);
+               RETURN_FALSE;
+       }
        do_pad = (input_size >= pad_size_abs) ? 0 : 1;
 
        /* Copy the original array */