MFH: recursion protection in count()

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 4c9da9f24e30c54650ed8d79d76c6fde0de22361..98666f3cfaea4fc06cb3e3494cb543c89c2bb7d4 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -283,6 +283,11 @@ static int php_count_recursive(zval *array, long mode TSRMLS_DC) /* {{{ */
        zval **element;
 
        if (Z_TYPE_P(array) == IS_ARRAY) {
+               if (Z_ARRVAL_P(array)->nApplyCount > 1) {
+                       php_error_docref(NULL TSRMLS_CC, E_WARNING, "recursion detected");
+                       return 0;
+               }
+
                cnt = zend_hash_num_elements(Z_ARRVAL_P(array));
                if (mode == COUNT_RECURSIVE) {
                        HashPosition pos;
@@ -290,7 +295,9 @@ static int php_count_recursive(zval *array, long mode TSRMLS_DC) /* {{{ */
                        for (zend_hash_internal_pointer_reset_ex(Z_ARRVAL_P(array), &pos);
                                 zend_hash_get_current_data_ex(Z_ARRVAL_P(array), (void **) &element, &pos) == SUCCESS;
                                 zend_hash_move_forward_ex(Z_ARRVAL_P(array), &pos)) {
+                               Z_ARRVAL_P(array)->nApplyCount++;
                                cnt += php_count_recursive(*element, COUNT_RECURSIVE TSRMLS_CC);
+                               Z_ARRVAL_P(array)->nApplyCount--;
                        }
                }
        }