From: Ilia Alshanetsky <iliaa@php.net>
Date: Mon, 3 Dec 2007 14:13:45 +0000 (+0000)
Subject: MFB:  Fixed bug #43482 (array_pad() does not warn on very small pad
X-Git-Tag: RELEASE_2_0_0a1~1245
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=678c532eee4fcf24757686e93fe8b9340fd38a2d;p=php

MFB:  Fixed bug #43482 (array_pad() does not warn on very small pad
numbers).
---

diff --git a/ext/standard/array.c b/ext/standard/array.c
index eec7a87beb..48be4e84e1 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -2684,6 +2684,11 @@ PHP_FUNCTION(array_pad)
 	/* Do some initial calculations */
 	input_size = zend_hash_num_elements(Z_ARRVAL_P(input));
 	pad_size_abs = abs(pad_size);
+	if (pad_size_abs < 0) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "You may only pad up to 1048576 elements at a time");
+		zval_dtor(return_value);
+		RETURN_FALSE;
+	}
 	do_pad = (input_size >= pad_size_abs) ? 0 : 1;
 
 	/* Copy the original array */