From: Rasmus Lerdorf <rasmus@php.net>
Date: Tue, 1 Apr 2003 21:47:21 +0000 (+0000)
Subject: MFB
X-Git-Tag: RELEASE_0_5~216
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=4b343a05628ed0150c2bdd239d59a689e8697e0b;p=php

MFB
---

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 1815f0c30e..58b5349bab 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -2465,6 +2465,10 @@ PHP_FUNCTION(array_pad)
 
 	/* Populate the pads array */
 	num_pads = pad_size_abs - input_size;
+	if(num_pads > 1048576) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "You may only pad up to 1048576 elements at a time");
+		RETURN_FALSE;
+	}
 	pads = (zval ***)emalloc(num_pads * sizeof(zval **));
 	for (i = 0; i < num_pads; i++) {
 		pads[i] = pad_value;